In the high-pressure world of financial technology, junior system administrator Tom was conducting a routine maintenance sweep on a critical Windows Server partition. What began as a mundane cleanup operation quickly spiraled into a digital forensic nightmare. During a seemingly innocuous file management task, an unexpected series of file operations were triggered – deletions, permanent removals, and mysterious renamings that left the system in a state of controlled chaos.
You can either answer directly or solve the challenge by running main.py in the Solution folder and providing your responses.
For answers:
- Separate values using an underscore (_).
- Arrange them in alphabetical order.
- Follow the specified flag format.
Q1: Which files were normally deleted?
Q2: Which files were permanently deleted?
Q3: Identify the files that were renamed, along with their new names. Use the format:
originalFile1_newNameFile1_originalFile2_newNameFile2
The solution as well as the flag can be found in the same folder, but it's advised to finish all the questions before checking the solution.
Chief Maintainer and Author
DFIR Labs