Question

What is the name of the "local user" account involved in the alleged actions (Hint: where in the file structure did you find the suspect files)? What was the IP address of the alleged offender workstation?

Answer 1

I will assume this is a windows computer

Answer:

• Disk (Letter)\Users\<"Answer">\Folder\Documents\SuspiciousFile.exe

• You can use Windows Security Logs to try and find out from what IP address the user you just found logged in from.

Explanation:

The windows user folder has folders that contain each users data, Using the file path of the suspicious file you can figure out which user is associated with the file.

Windows Security Logs collect data on logon attempts so when the user logs in their IP address should be collected in these log files.