Forensics Level 5: Universal Swindlers Bayonet
Anusandhaanic Daakus Ltd. Is a company whose strength lies in the researches it conducts. Very often the employees leaving the organisation manage to carry the research data alongwith. This time company decided to go for the investigation and called upon a forensic investigator. This investigator captured the memory dump and shut the system down. On resuming the system he finds that the drive has been encrypted and is left with only the memory dump.
You as an investigator are required to find out the following information from the dump 1) Serial No. of external drive
2) Date and time (IST) when the drive was first connected
3)Date and time (IST) when the drive was last connected
4) Launching which other executable (Not nullcon.exe>) resulted in launching of nullcon.exe

null.rar