Evidence Category · 10 Questions

Nested Image and Container

Measures analysis of nested structures and layered containers.

Questions in This Category

Q014Flag after decrypting the encrypted container in the embedded inner image?

Q015Where does the key opening the inner encrypted container come from? (source)

Q016Owner of the file in the inner image?

Q017First key fragment inside pagefile.sys?

Q018Content of the VAULT.ENC file?

Q098Marker of the embedded inner image region?

Q099Key fragment label in pagefile.sys?

Q100Which encryption protects VAULT.ENC?

Q101Header signature of the inner encrypted container?

Q163Which Windows file type does SYSTEM.SAV imitate?