Using the SOFTWARE registry hive from the ForensicImage01.E01 evidence file, which web browser is the default installed internet browser? 

Using the NTUSER.DAT registry hive from the ForensicImage01.E01 to determine the last command executed by user Jethro via the Run window.

Export the NTUSER.DAT registry hive from user Jethro’s profile folder in the provided disk imageForensicImage01.E01, and determine which of the following files was most recently accessed by the user.

Using the NTUSER.DAT registry hive from the ForensicImage01.E01 evidence file, which of the following URLs was the last typed in Internet Explorer by user Jethro?

Using the NTUSER.DAT registry file from the ForensicImage01.E01 evidence file, which of the following programs is the most frequently run by the user Jethro?

Note: NTUSER.DAT is a hidden system file. After exporting it from FTK Imager, ensure that hidden files are enabled in your operating system so the file is visible in the destination folder. If the file does not appear correctly after export, repeat the export to the same folder to ensure it is fully extracted.

Using FTK Imager to analyse the provided disk image, navigate to the Granny user profile and locate the file with the MD5 hash value 6e02a1b80fbe23b5cfd8046d69bb3dee

What is the amount of disk space allocated to this file by the file system (in bytes)?

Use FTK Imager to determine the size of the acquired disk image ForeniscImage01.E01.  What is the size of this disk image?

What is the file slack size of the file Options.doc on Buddy's desktop?

Use FTK Imager and the provided disk image ForeniscImage01.E01 to determine the MD5 hash value of the given disk image.

Use FTK Imager and the provided disk image ForeniscImage01.E01 to determine the name of the examiner associated with the given disk image.

What is the name of the examiner associated with the given disk image?