1. What user has the SID which ends with 1003?
2. On page 8 of the document “Daniel Ocean Bio.doc” is a reference to an MD5. What is the name of the file which matches that MD5?
3. What software was used to edit the picture, f_000631?
4. Using the Prefetch file for the executable, Windirstat.exe; What was the last date and time it was run?
1. Which British news source is within the Typed URL’s for Daniel’s user?
2. Of the identified encrypted files, how many of them are “actual files?”
3. On the Explore Tab, Quickpick only the ACE Image content. How many of the listed files are Alternate Data Streams?
