W5 Mon 27082018

Do workshop 5.

000001F4 - Username Administrator, Description Built-in account for administering the computer/domain, SID 500

000001F5 - Username Guest, Description  Built-in account for guest access to the computer/domain, SID 501

0000003E9 - Username jfriday, Fullname jfriday, SID 1001

0000003EB - Username HomeGroupUser$, Description Built-in account for homegroup access to the computer, SID 1003

0000003EC - Username Denise, Fullname Denise Robinson, SID 1004

SID info - https://www.itprotoday.com/management-mobility/what-sid-security-id

Q10.1 The denise have never login this computer.

Q10.2 7 times

Q10.3 2 of them including administrator and guest.

Q10.4 Administrator and Guest account

Q10.5 True

Q10.6 7 hives

Q11. GCFI5E

Q12. Time zone is PST

Q14.1 GCFI5E

Q14.2 PST

Q14.3 What kinds of device was connected to the computer.

Q14.4 2

Q14.5 A devices connected to the computer including IDE and USB devices.

Q17.1 Because the NTUSER.dat file was extracted from denise user folder.

Q17.2 denise.robinson5@outlook.com