Encrypted Files Case Study #1

In this case study, a series of encrypted files are identified within the sample evidence that investigators are given the task of investigating. This includes reviewing the files to find their origins, retrieve the original contents of these files before they became encrypted, and locate evidence of software that was used to perform these encryption algorithms. This case study will use Windows Prefetch, Jump List, Registry UserAssist, and Volume Shadow Copy artifacts to recover information regarding such encrypted files.