Insider-Threat Forensic Examination
Windows 10 disk image examined for a simulated insider-threat matter, reported as expert witness testimony
CS 473 Digital Forensics · Oregon State University · Spring 2026
A forensic examination of a Windows 10 workstation disk image, delivered as a formal expert witness report written for counsel and non-technical readers. The report covered evidence handling, methodology, findings, a reconstructed timeline, and recommended follow-on examination. Most of the analytical work was exclusion: seven keyword hits reduced to a defensible set, and every timestamp qualified against a clock that could not be trusted.
Scope
Forensic examination of a Windows 10 workstation disk image in a simulated insider-threat matter, delivered as a formal expert witness report written for counsel and non-technical readers. The report covered evidence handling, methodology, findings, a reconstructed timeline, and recommended follow-on examination.
The image was acquired by a designated lead analyst in the exercise scenario. I received, verified, and examined it — I did not perform the acquisition.
Environment & tooling
An E01 forensic image of a Windows 10 workstation, examined in an isolated VMware vSphere lab.
- Autopsy 4.21
- Image analysis, hive extraction, keyword search
- FTK Imager 4.5
- Mounting, hash verification
- Registry Explorer
- Registry parsing (Eric Zimmerman)
- ShellBags Explorer
- Shell item parsing (Eric Zimmerman)
- Windows Event Viewer
- Event log analysis
- HxD
- Hex-level file signature analysis
Method
Malware identification
Parsed Windows Defender detection records and identified a Meterpreter remote-access payload staged on removable media, extracting the threat ID, severity, SHA-256 hash, parent process, user context, and the remediation action taken. Defender had suspended the file.
Corroboration across independent sources
Established the detection independently across three sources: the Defender detection record, the Defender Operational event log, and a deleted record recovered by carving unallocated space.
False positive triage
A full-image keyword search across live files, deleted files, the page file, and unallocated space returned seven hits, which sorted into three groups. Hits originating from network scanner probe signature files and from the antivirus signature cache database were excluded — those files legitimately contain thousands of malware names and are not indicators of compromise. Only the remaining hits were reported as findings.
Anti-forensics detection
Identified a system clock correction of 58,551 seconds (approximately 16.3 hours) that Windows refused to apply because it exceeded the maximum permitted adjustment. Every timestamp in the affected window was qualified accordingly in the report rather than being presented as reliable.
Timeline correlation
Correlated Windows Portable Device driver installation events against the antivirus detection to establish a 26-second interval between the removable device being connected and the execution attempt.
Registry analysis
Examined SYSTEM, SOFTWARE, SAM, NTUSER.DAT, and UsrClass.dat hives. USBSTOR and MountedDevices for removable media attribution; UserAssist, RecentDocs, RunMRU, TypedPaths, ComDlg32 MRU keys, MountPoints2, and Terminal Server Client keys for user activity; ShellBags for Explorer navigation history that persists after folders are deleted.
Event log analysis
Parsed 2,569 SYSTEM event log records, separating security-relevant events from benign infrastructure noise — network adapter link loss producing DNS timeouts, and an absent TPM provider. Flagged a Service Control Manager service start-type change as a possible persistence mechanism warranting further examination.
- T+0
Removable device connected
Windows Portable Device driver installation events recorded in the SYSTEM event log.
- T+26s
Execution attempt
Meterpreter remote-access payload staged on the removable media is executed.
- Outcome
Payload suspended
Windows Defender remediated the file. No artifact examined shows the payload running successfully.
Timestamps qualified: a system clock correction of 58,551 seconds (~16.3 hours) was attempted in the affected window and refused by Windows for exceeding the maximum permitted adjustment. Every timestamp in that window was reported with that caveat attached rather than as reliable.
Findings
- A Meterpreter remote-access payload was staged on removable media and detected by Windows Defender, which suspended the file before execution completed.
- The detection was corroborated independently across three sources — the Defender detection record, the Defender Operational event log, and a record recovered by carving unallocated space.
- Of seven keyword hits, those originating from network scanner probe signature files and from the antivirus signature cache database were excluded — such files legitimately contain thousands of malware names and are not indicators of compromise.
- A system clock correction of 58,551 seconds was attempted and refused by Windows, rendering every timestamp in the affected window qualified rather than reliable.
- 26 seconds elapsed between the removable device being connected and the execution attempt.
- A Service Control Manager service start-type change was flagged as a possible persistence mechanism warranting further examination.
Limits & what would confirm
What the available evidence did not establish, and what it would take to settle each open question.
Removable media attribution was based on drive letter and shell item evidence.
Would confirm: Confirming which physical device was connected requires USBSTOR and MountedDevices correlation in the SYSTEM hive, matched against device serial numbers.
ShellBag entries evidence that a folder view was rendered in Explorer. They do not establish that files were opened, copied, or exfiltrated.
The payload was suspended by Defender before execution. There is no evidence in the examined artifacts that it ran successfully.
Account activity establishes what a set of credentials did, not who was physically at the keyboard.
Clock manipulation is consistent with anti-forensic intent but has innocent explanations, including time synchronization failure and manual correction of a drifted clock.
Takeaway
In a keyword-driven investigation, the analytically valuable work is often exclusion rather than discovery. Reporting a signature database as evidence of infection would have been a significant error, and the artifacts that were absent constrained the conclusions as much as the artifacts that were present.
Tools & techniques
This page describes my own methodology, reasoning, and analysis. Course materials — assignment prompts, instructor- supplied evidence, lab handouts, and graded reports — are not reproduced here, and case-scenario names, hostnames, usernames, and device identifiers have been removed.