You’ll want to pull the Challenge Image from SYNCED_FILES if possible.

• If you can’t find it there,
  • You can download this challenge image here

Somewhere within one of the sub-directories of c:\Windows\System32 is a file that has been changed so that it is owned by one of the users on the system.

Answer Forensic Question 2 Correctly and show that is correct either by screenshotting the Notepad with the answer or the scoring report

This

Or This