AC468 Unit 3 File System Artifact Review Example

Course	AC468 Digital Forensics and Investigative Techniques
Unit	Unit 3
Paper type	File system artifact review
Length	About 560 words, 5 pages double-spaced
Format	APA 7 student paper
School	Purdue University Global
Program	BS in Accounting
Updated	October 2026

Free sample paper for AC468 Unit 3

Notes About a File Nobody Kept: A Unit 3 File System Artifact Review of an Accounts Payable Laptop

[Student Name]

Purdue University Global

AC468: Digital Forensics and Investigative Techniques

Unit 3 File System Artifact Review

[Instructor Name]

[Date]

Belmonte Fine Foods, its staff and every artifact are composite; the books and guide cited are real.

What this part is doingNaming the five artifacts and the review's three questions in the lead shows its method.

Shortcut File

Path: the user's Recent folder, a file named after the bank-change letter with the .lnk extension. Windows creates a shortcut like this when a document is opened. The shortcut records the target's path on drive E:, the target's size and timestamps, and the serial number of the volume it lived on. That volume serial number matches the FAT32 flash drive imaged as Item 2. Supports: a document with this name was opened from the flash drive while connected to this laptop. Does not show: who was at the keyboard.

Jump List

Path: the AutomaticDestinations jump list for Microsoft Word in the user's profile. It lists the same document opened four times, the first on March 13 at 19:08 UTC and the last on March 17 at 15:21 UTC. Supports: repeated work on the letter across five days in this account.

USB Device Registry Records

Path: the USBSTOR and related keys in the SYSTEM hive, and the user's MountPoints2 key in NTUSER.DAT. The device serial number matches the flash drive. First connected March 13 at 19:02 UTC; last connected March 20 at 14:47 UTC. The MountPoints2 entry ties the drive's mounting to this user account. Supports: the flash drive was used under this account on the dates shown.

Shellbags

Path: the shellbag keys in the user's UsrClass.dat. They record the account browsing a folder on E: named for the supplier, with a last-interaction time of March 17 at 15:18 UTC. Supports: the folder existed and was viewed in Windows Explorer from this account.

Master File Table Entry

The laptop's master file table holds a deleted entry for a file of the same name on the user's desktop. Its standard information timestamps show creation on February 2, while its file name timestamps show creation on March 17 at 15:24 UTC. The standard information values can be changed with ordinary tools; the file name values are much harder to alter.

When a file's standard information timestamps are earlier than its file name timestamps, the most likely explanation is that the visible dates were changed after the file was created, which makes the February date unreliable and the March date the better evidence.

What this part is doingThe highlighted sentence explains the timestamp inconsistency, the analytical point graders look for in this review.

Reading the Artifacts Together

Five artifacts written by different parts of the operating system agree: the letter lived on the flash drive, was opened repeatedly from it under this account between March 13 and March 17, was copied to the desktop on March 17 and later deleted, and its desktop copy's visible creation date was set back. Artifacts like these record what a system did with a file, even after the file is gone (Carrier, 2005). Each was cross-checked against the laptop's 2 minute 14 second clock lag before conversion to UTC (Casey, 2011).

What They Cannot Show

None of these records identify a person. They show actions taken under the employee's account on her laptop. Whether someone else had her password or access to the device is a question for the sign-in records and interviews (Kent et al., 2006).

What this part is doingEnding on the limits of attribution keeps the review within what artifacts can prove.

References

Carrier, B. (2005). File system forensic analysis. Addison-Wesley.

Casey, E. (2011). Digital evidence and computer crime: Forensic science, computers, and the Internet (3rd ed.). Academic Press.

Kent, K., Chevalier, S., Grance, T., & Dang, H. (2006). Guide to integrating forensic techniques into incident response (NIST Special Publication 800-86). National Institute of Standards and Technology. https://doi.org/10.6028/NIST.SP.800-86

What the AC468 Unit 3 assignment asks for

The third AC468 unit asks you to review operating system artifacts and say what each establishes. For every artifact, give its location on the image, the time it records converted to UTC, and plain language about what it supports. Typical sources are shortcut files, jump lists, USB registry keys, shellbags and the master file table. Cross-reference artifacts that point to the same file or device, such as a volume serial number in a shortcut matching a flash drive. Explain any conflict between timestamp sets and the possible causes. Organize findings by what they prove, presence, use or source, rather than by disk location. Close with what the artifacts cannot show, especially who was at the keyboard. Cite a file system text, an evidence text and a forensic guide in APA 7.

How the AC 468 Unit 3 example is put together

The sample begins with the shortcut file in the Recent folder and its volume serial number, which matches the flash drive. The jump list section gives the first and last opening times. Registry keys under USBSTOR and MountPoints2 record the drive's device serial and its first and last connections under this account. Shellbags show a folder named for the supplier browsed on March 17. The master file table section sets standard information times against file name times, and the highlighted sentence explains why the earlier visible date is the less reliable one. A combined reading then shows five independent records agreeing on the letter's path from flash drive to desktop. The last section states that every finding is about an account and device, not a person.

Where the points sit in the AC468 Unit 3 rubric

Graders on this AC468 unit look for correct interpretation of each artifact, not a catalog. The rubric gives points for accurate paths, conversion of times to UTC, and a clear statement of what each artifact supports and its limit. Cross-referencing earns credit: matching a volume serial or device serial between sources shows the student understands how artifacts corroborate each other. A timestamp conflict handled carefully, with alternative causes named, usually separates top work from average work. Reviews that conclude a named person did something lose points, because these records attribute actions to accounts. Clear organization by what is proven, and APA 7 citations to standard file system references, complete the expected work.

AC468 Unit 3 help: mistakes that cost points

Weak Unit 3 reviews list artifacts with their locations but never say what they mean for the case. Times are left in local or mixed zones, so a reader cannot order events. Matching serial numbers are noted in one place but never connected across sources. Standard information and file name timestamps are treated as interchangeable, missing the most telling detail in the evidence. Conclusions jump from an account's activity to a person's guilt. Organization by disk location rather than by what each finding shows hides the argument. If your section gave you its own practice image or tool output, our writers can build the review from those artifacts with each finding's limit stated.

Get an AC468 Unit 3 example written to your instructions

Which operating system and version does the practice image run? That answer decides which artifacts exist, so it belongs in the Unit 3 request beside any tool output supplied and the rubric. Each artifact comes back with its path, a UTC timestamp and the limit of what it shows. The first custom review is free, 24-48h. The paper above is an original model document written by our desk, not a submitted student paper and not an official Purdue University Global document.

More AC468 papers and BS in Accounting samples

AC468 Unit 3 questions, answered

What is a shortcut file, and why does it matter?

Windows creates a shortcut, a small file with the .lnk extension, when a document is opened, and it records the target's path, size, timestamps and details of the volume it was on. It often survives after the target is deleted. That is why it can show a document once existed and where, even when the document itself is gone.

Can timestamps on a file be trusted?

Only after they are tested. Some timestamps can be changed with ordinary tools, clocks can be wrong, and moving or copying a file can reset some dates while keeping others. The review compares timestamps from independent sources, such as the master file table's two attribute sets and the shortcut file, and treats agreement as support rather than proof.

Can the review use the practice image my section provided?

Yes. Send the image details, any tool output your section expects you to interpret, the prompt and the rubric. Artifacts found on that system are reported with paths and UTC times, each finding carries its interpretation limit, and places are marked for values your own examination will produce.

Where can I find a free AC468 Unit 3 sample paper?

This page holds a full AC468 Unit 3 file system artifact review of a laptop at Belmonte Fine Foods covering a shortcut file, jump list, USB registry keys, shellbags and a master file table entry, with APA 7 references.

What do shellbags show in this review?

They record folders viewed in Windows Explorer from a user account, even after the folder or drive is gone. In the sample they show a folder named for the supplier on the flash drive's E: letter browsed on March 17, which supports viewing from that account but not who was viewing.