We had quite the strong showing last week from Maxim Suhanov. Who else is ready to stand up to the challenge? This week and next week we are focusing on what I think is unexplored territory that is rapidly expanding during the crisis, remote work and conferencing tools. I'm sure all of us will be investigating things that originated from interactions in these tools. Let's start with something I couldn't google and find quickly, Microsoft Teams.
The Prize:
$100 Amazon Giftcard
The Rules:
- You must post your answer before Friday 4/17/20 7PM CST (GMT -5)
- The most complete answer wins
- You are allowed to edit your answer after posting
- If two answers are too similar for one to win, the one with the earlier posting time wins
- Be specific and be thoughtful
- Anonymous entries are allowed, please email them to dlcowen@gmail.com. Please state in your email if you would like to be anonymous or not if you win.
- In order for an anonymous winner to receive a prize they must give their name to me, but i will not release it in a blog post
The Challenge:
When looking at Microsoft Teams from a DFIR perspective:1. Where are the artifacts?
2. What format are they in?
3. Can you recover chat history?
4. Can you recover call history?
5. Can you recover file transfer?
6. Can you recover meeting history?
7. Anything else you can determine?
Also Read: Daily Blog #670
Nice post thank you Justin
ReplyDelete