Forensics · Lesson 17
Forensics Practice Case
Work through a complete fictional CyberPatriot-style evidence set and practice turning browser, file, account, scheduler, process, network, service, and security evidence into one defensible explanation.
This case is intentionally multi-source. The goal is not to find one magic artifact. The goal is to choose the right evidence, correlate it, and stop exactly where the evidence stops.
Case Snapshot
Learning objectives
Apply the complete forensic reasoning workflow
Apply the full CyberPatriot forensics workflow to one fictional multi-source case.
Identify the strongest evidence source for each question before drawing a conclusion.
Correlate authentication, browser, file, archive, scheduled-task, process, service, network, and security-product evidence.
Separate direct observations from supported inferences and unsupported claims.
Build a concise timeline while preserving uncertainty, timestamp context, and competing explanations.
Practice writing short, defensible forensic answers that explain what happened and what remains unknown.
Case rules
Treat the evidence like a real competition question
Use only the provided evidence
Do not invent missing logs, assume intent, or rely on facts that are not present in the case.
Separate observation from inference
State what each artifact directly proves before combining sources into a broader conclusion.
Preserve timestamp meaning
Treat browser, filesystem, archive, process, event-log, and network times as different evidence types.
Corroborate important links
Strong conclusions should connect at least two independent artifacts when possible.
Do not confuse capability with action
Administrator membership, sudo access, macro capability, and service privilege do not prove those capabilities were used.
Record uncertainty
If the evidence supports multiple explanations, say so explicitly instead of forcing one answer.
Scenario
Fictional case background
Host
CP-LAB-17
Platform
Windows 11 training VM
Primary account
trainee17
Authorized software
Browser, PowerShell, document viewer, Defender, LabReporter service
Required service
LabReporter must remain enabled
Time window
13:00-14:00 local time
Safety boundary
All hosts, addresses, files, and events are fictional training artifacts
Evidence set
Read every artifact before deciding what happened
Each card includes the direct observation supported by that artifact. Broader conclusions come later.
Windows Security
Event 4624 records a successful interactive logon for trainee17 with logon type 2.
Directly supports
Windows accepted authentication for trainee17 and created an interactive session.
Browser History
Browser visits https://training.example/resources/utilities.
Directly supports
The browser recorded a visit to that training URL.
Browser Download
File utility-pack.zip is downloaded to C:\Users\trainee17\Downloads\utility-pack.zip.
Directly supports
The browser recorded a download to that path.
Filesystem
utility-pack.zip appears in Downloads with size 126 KB and SHA-256 HASH-ZIP-17.
Directly supports
The local archive existed at that path with that size and hash.
Archive Listing
utility-pack.zip contains scripts/helper.ps1, docs/readme.txt, and bin/reporter-helper.exe.
Directly supports
Those paths are recorded inside the archive.
Archive Metadata
helper.ps1 has an internal modification timestamp of 2025-02-14 08:20.
Directly supports
The archive stores that internal modification timestamp.
Filesystem
helper.ps1 appears at C:\Users\trainee17\AppData\Local\UtilityLab\helper.ps1.
Directly supports
The script existed locally at that path by 13:09:31.
File Hash
Extracted helper.ps1 hash matches the hash of helper.ps1 stored in the archive.
Directly supports
The extracted script content is identical to the archived script content.
Windows Security
Event 4720 records creation of local account report-helper.
Directly supports
The report-helper account was created at that time.
Windows Security
Event 4732 records report-helper added to local Administrators.
Directly supports
The account gained local administrative group membership.
Task Scheduler
Task UtilityCheck is registered to run every 15 minutes as report-helper.
Directly supports
A scheduled task was created with that schedule and run-as account.
Task Action
UtilityCheck action launches powershell.exe with helper.ps1 as an argument.
Directly supports
The task is configured to launch PowerShell with that script.
Task Scheduler Operational
UtilityCheck trigger fires.
Directly supports
The scheduler recorded a trigger event for UtilityCheck.
Process Evidence
powershell.exe starts as PID 6204 under report-helper with helper.ps1 in the command line.
Directly supports
PowerShell executed under report-helper and referenced helper.ps1.
Process Evidence
PowerShell starts reporter-helper.exe as child PID 6210.
Directly supports
The child process was launched by the PowerShell process.
Network State
PID 6210 establishes TCP connection to fictional 203.0.113.171:443.
Directly supports
The child process communicated with that fictional remote endpoint.
Defender
Defender scans reporter-helper.exe and records no detection.
Directly supports
Defender scanned the file and did not flag it in this fictional record.
Windows System
Service LabReporter enters the running state.
Directly supports
The required LabReporter service was running at that time.
Service Configuration
LabReporter runs from C:\ProgramData\LabReporter\reporter.exe under LocalService.
Directly supports
The service uses that executable path and account.
Network State
LabReporter process listens on 127.0.0.1:8099.
Directly supports
The required service is listening only on loopback at that moment.
Filesystem
readme.txt is opened by the document viewer from the extracted UtilityLab directory.
Directly supports
The text document was opened by the viewer application.
Task Scheduler Operational
UtilityCheck triggers a second time.
Directly supports
The scheduler recorded a second trigger.
Process Evidence
reporter-helper.exe again appears as a child of powershell.exe.
Directly supports
The same parent-child execution chain occurred again.
Network State
reporter-helper.exe again connects to fictional 203.0.113.171:443.
Directly supports
The process made another connection to the same fictional endpoint.
Team Change Log
Team records report-helper account state, group membership, task configuration, file hashes, process chain, and network evidence.
Directly supports
The team documented relevant evidence before making changes.
Team Change Log
Team disables UtilityCheck after confirming it is not required by the fictional scenario.
Directly supports
The scheduled task was disabled as a defensive action.
Team Change Log
Team disables report-helper after confirming no required service depends on it.
Directly supports
The account was disabled after preservation and requirement review.
Evidence map
Group artifacts by the question they answer
Authentication & account
E01, E09, E10
Establishes session start, account creation, and privilege change.
Browser & file arrival
E02-E08
Establishes web activity, download, archive contents, extraction, and file identity.
Scheduler & process
E11-E15, E22-E23
Establishes recurring scheduled execution and parent-child process relationships.
Network
E16, E20, E24
Separates outbound helper connections from the required local-only service listener.
Security product
E17
Adds independent scan context but does not prove trustworthiness.
Required service
E18-E20
Shows that LabReporter is a separate, required component with a different path, account, and network behavior.
Team actions
E25-E27
Separates original evidence from defensive changes.
Key case questions
Build each answer from the strongest available evidence
How did helper.ps1 arrive on the system?
The strongest evidence is the browser download of utility-pack.zip, the archive listing showing scripts/helper.ps1, the later extracted AppData copy, and matching hashes between archived and extracted content.
Confidence: High
Does the 2025 timestamp prove helper.ps1 existed locally in 2025?
No. That is an archive-internal timestamp. The local extraction evidence places helper.ps1 on this VM at 13:09:31.
Confidence: High
What changed the account privilege state?
report-helper was created at 13:10:07 and added to local Administrators at 13:10:22.
Confidence: High
What explains recurring execution?
UtilityCheck was configured to run every 15 minutes as report-helper and launch PowerShell with helper.ps1. Task triggers and process evidence at 13:15 and 13:30 corroborate actual execution.
Confidence: High
What caused the outbound connection?
The strongest supported chain is UtilityCheck trigger → powershell.exe → reporter-helper.exe → TCP connection to 203.0.113.171:443.
Confidence: High
Is LabReporter the same component as reporter-helper.exe?
No evidence supports that. LabReporter runs from ProgramData under LocalService and listens on loopback 8099, while reporter-helper.exe is launched from the UtilityLab chain and makes outbound connections.
Confidence: High
Does Defender's no-detection result prove reporter-helper.exe is safe?
No. It only proves that the fictional scan record contained no detection at that time.
Confidence: High
Did trainee17 personally create report-helper?
The case proves the account was created during trainee17's active session, but it does not directly prove who physically initiated the account-creation action.
Confidence: Moderate
Direct vs inferred
Classify the statement before using it
utility-pack.zip was downloaded to the trainee17 Downloads directory.
Direct
Evidence: E03-E04
helper.ps1 came from utility-pack.zip.
Correlated inference
Evidence: E05, E07, E08
report-helper had administrative capability.
Direct
Evidence: E10
report-helper used administrative privileges during the task.
Unsupported
Evidence: No event in the case proves privileged action.
UtilityCheck caused recurring PowerShell execution.
Strong correlated inference
Evidence: E11-E14, E22-E23
203.0.113.171 is malicious.
Unsupported
Evidence: The case only records fictional network connections.
Competing explanations
Identify what the case still cannot prove
Who created report-helper?
Possible explanations: An interactive user, an administrative script, or another process operating during the session.
Needed for stronger conclusion: Account-creation event timing plus process or command evidence would be needed for stronger attribution.
Why was utility-pack.zip downloaded?
Possible explanations: Training activity, testing, automation, or another purpose.
Needed for stronger conclusion: Scenario context or user/task instructions would be needed to establish intent.
Why did reporter-helper.exe connect outbound?
Possible explanations: Expected training behavior, telemetry, update behavior, or unauthorized activity.
Needed for stronger conclusion: Application configuration, scenario requirement, destination context, or application logs would be needed.
Was the file trusted because Defender did not flag it?
Possible explanations: No detection can mean benign content, missing signature, limited coverage, or no relevant detection rule.
Needed for stronger conclusion: Do not infer trust from no-detection alone.
Case timeline
Normalize the sequence without losing source context
Decision points
Use scenario requirements before changing the system
Keep LabReporter
The scenario says it is required, and the evidence shows it is a separate service with a local-only listener.
Review UtilityCheck
It is not listed as required and directly explains recurring execution of the extracted script.
Review report-helper
It is newly created, privileged, used by UtilityCheck, and not required by a scenario dependency.
Do not treat no-detection as approval
Defender's fictional result is one evidence point, not a trust decision.
Preserve before disablement
Task, account, file, process, and network evidence should be captured first.
Keep conclusions narrow
The case supports execution and network activity but not malicious intent or human attribution.
Short-answer drill
Practice concise evidence-backed answers
Drill 01
Identify the strongest evidence that utility-pack.zip was downloaded.
E03 browser download record plus E04 matching local archive appearance.
Drill 02
Identify the strongest evidence that helper.ps1 came from the archive.
E05 archive listing, E07 extracted local path, and E08 matching hash.
Drill 03
Identify the strongest evidence of persistence.
E11-E12 task registration and action, corroborated by E13-E14 and E22-E23 execution.
Drill 04
Identify the strongest evidence of outbound communication.
E16 and E24, both tied to reporter-helper.exe process activity.
Drill 05
Identify one fact that should not be overclaimed.
The no-detection Defender scan does not prove reporter-helper.exe is safe.
Drill 06
Identify one necessary service that should not be disabled.
LabReporter, because the scenario explicitly requires it.
Final case review
Write the complete answer without overclaiming
Question 01
What is the best concise explanation of the main event chain?
During trainee17's session, utility-pack.zip was downloaded, helper.ps1 was extracted with matching content, report-helper was created and privileged, UtilityCheck was registered to run helper.ps1 every 15 minutes, the task launched PowerShell and reporter-helper.exe, and that child process made repeated outbound connections.
Question 02
Which part of that explanation is inference rather than a single direct artifact?
That helper.ps1 came from the downloaded archive and that UtilityCheck caused the process chain are correlated conclusions supported by multiple artifacts.
Question 03
What should remain explicitly unknown?
Intent, who physically initiated the account creation, whether the remote endpoint was benign or malicious, and why the archive was downloaded.
Question 04
What defensive actions are justified by the fictional scenario?
Preserve evidence, review and disable UtilityCheck if not required, disable report-helper if no dependency requires it, and leave LabReporter enabled because it is required.
Question 05
What should be documented as team-generated evidence?
The 13:35-13:36 preservation and disablement actions should be kept separate from the original event sequence.
Question 06
What makes this case high confidence overall?
The major links are corroborated across independent browser, filesystem, account, scheduler, process, network, service, and change-log evidence.
Common mistakes
Errors that would weaken this case analysis
Calling the remote host malicious
The case only shows a connection to a fictional endpoint.
Treating Defender no-detection as trust
No detection is not proof of safety.
Blaming trainee17 directly
The session timing supports context, but not physical-person attribution.
Disabling LabReporter
The scenario explicitly requires it and the evidence separates it from reporter-helper.exe.
Using the 2025 archive timestamp as local history
The archive-internal mtime does not prove earlier local existence.
Ignoring the second task execution
Repeated execution strongly supports persistence and recurring behavior.
Deleting before hashing
That would weaken file-identity evidence.
Merging team actions into original activity
Defensive disablement must remain clearly separated in the timeline.
Case checklist
Before moving to the final review
I started with the forensic question, not the answer I expected.
I used direct artifacts before making inferences.
I connected download, extraction, and hash evidence.
I separated account privilege from proof of privileged action.
I used task history plus process evidence to prove recurring execution.
I mapped network activity to the owning child process.
I separated LabReporter from reporter-helper.exe.
I kept archive-internal time separate from local extraction time.
I preserved uncertainty about human attribution and intent.
I treated Defender no-detection as limited evidence.
I separated team changes from original system events.
I wrote a concise conclusion that stays inside the evidence.
Reflection
Check your case reasoning
Question 1
Which artifact in the case would you trust least if viewed alone, and why?
Question 2
What additional evidence would most improve attribution for the report-helper account creation?
Question 3
Why does the second UtilityCheck execution increase confidence in the persistence conclusion?
Question 4
What evidence proves LabReporter and reporter-helper.exe are separate components?
Question 5
Which statements in the case are direct observations and which are correlated conclusions?
Question 6
How would you summarize this case in three sentences without overclaiming?
Carry this forward
The strongest forensic answers are short, source-driven, and explicit about uncertainty. Correlate aggressively, but never claim more than the artifacts support.