| Course | AC468 Digital Forensics and Investigative Techniques |
|---|---|
| Unit | Unit 5 |
| Paper type | Browser and account activity analysis |
| Length | About 770 words, 5 pages double-spaced |
| Format | APA 7 student paper |
| School | Purdue University Global |
| Program | BS in Accounting |
| Updated | October 2026 |
Free sample paper for AC468 Unit 5
A Registrar Page Five Days Early: A Unit 5 Browser and Account Activity Analysis of an Accounts Payable Profile
[Student Name]
Purdue University Global
AC468: Digital Forensics and Investigative Techniques
Unit 5 Browser and Account Activity Analysis
[Instructor Name]
[Date]
Belmonte Fine Foods, its staff, domains and every log entry are composite; the guide, article and book cited are real.
Sources and Time Formats
Three sources were examined, each from a verified copy. The first is the History database of the Edge profile on the laptop image, a SQLite file whose visit times are stored as microseconds counted from January 1, 1601, in UTC. The second is the unified audit log for the employee's mailbox, exported from the company's cloud tenant, which records operations in UTC. The third is the tenant's sign-in log for her account, also in UTC, retained for thirty days under the company's license.
Every browser time was converted from its stored count to a calendar date, then compared with the slow firmware clock noted in Unit 2. The lag does not affect browser times written by the operating system's synchronized clock after March 1, when the laptop last contacted the company's time server, but it is noted beside each row so a reader can apply it if needed.
Browser History
On March 12 at 17:31 UTC the profile requested the checkout page of a domain registrar. The page address carries, as a query value, the supplier's name with one inserted hyphen, a lookalike of its genuine address. Two minutes later the profile requested the registrar's order confirmation page. No other visit to that registrar appears in the profile's history, which runs back to November.
On March 17 the profile visited the login page of a free webmail provider at 15:06 UTC and the provider's inbox page at 15:07 UTC. The spoofed message reached Belmonte's tenant at 15:38 UTC. Browser artifacts of this kind record what a profile requested and when, and correlating them with other sources is the established way to place them in a sequence (Oh et al., 2011).
Mailbox Audit Records
The audit log shows the March 17 message opened from the employee's mailbox at 15:40 UTC, two minutes after it arrived. At 15:50 UTC a new inbox rule was created in the same mailbox. It moves any message from the supplier's real domain into a folder named Archive 2019 and marks it as read. Between March 18 and April 1, nine genuine messages from the supplier, including two payment queries, were moved by that rule.
Sign-In Records
Every sign-in to the account between March 1 and March 31 came from the office network or from one residential address that appears throughout the prior year. Multifactor authentication was satisfied on each. No sign-in came from a foreign address, a hosting provider or a new device.
Findings Table
1. March 12, 17:31 UTC, Edge history: registrar checkout page for the lookalike domain requested from this profile.
2. March 17, 15:06 UTC, Edge history: webmail login page requested from this profile.
3. March 17, 15:38 UTC, tenant message trace: spoofed message received.
4. March 17, 15:40 UTC, audit log: message opened from this mailbox.
5. March 17, 15:50 UTC, audit log: inbox rule hiding the genuine supplier created in this mailbox.
6. March 1 to 31, sign-in log: all sessions from known locations with multifactor authentication.
Every finding is attributed to a profile, a mailbox or a session, never to a person, because each source records which account or device acted and none records whose hands were on the keyboard.
Testing the Outside-Compromise Explanation
The first alternative any reviewer will raise is that an attacker held the account's credentials. That explanation predicts sign-ins from unfamiliar addresses or devices, a newly registered authentication method, or a session token used from two places at once. None appears. It does not predict registrar visits from the laptop's own browser profile five days before the message, because an attacker using stolen credentials works through the cloud account, not through a browser on a desk in the office.
Two limits remain. Private browsing windows leave no history, so the absence of other visits proves nothing about what else the profile did. A stolen session token can be replayed from a trusted network if the attacker already has a foothold on it, which is why the analysis recommends a malware review of the laptop image before any conclusion is drawn (Kent et al., 2006). Timestamp provenance across sources also matters: entries agree in order only because each was converted to one reference (Schatz et al., 2006).
References
Kent, K., Chevalier, S., Grance, T., & Dang, H. (2006). Guide to integrating forensic techniques into incident response (NIST Special Publication 800-86). National Institute of Standards and Technology. https://doi.org/10.6028/NIST.SP.800-86
Oh, J., Lee, S., & Lee, S. (2011). Advanced evidence collection and analysis of web browser activity. Digital Investigation, 8, S62-S70. https://doi.org/10.1016/j.diin.2011.05.008
Schatz, B., Mohay, G., & Clark, A. (2006). A correlation method for establishing provenance of timestamps in digital evidence. Digital Investigation, 3, 98-107. https://doi.org/10.1016/j.diin.2006.06.009
What the AC468 Unit 5 assignment asks for
In Unit 5 of AC468 you analyze user activity from more than one source and decide what each can attribute. Identify each source, its storage format and its time standard, and convert every time to UTC. Read browser history for visits relevant to the case and say what a visit records. Read mailbox audit entries for operations such as messages opened and rules created. Read sign-in records for locations, devices and authentication. Align the three in a findings table. Then test the leading alternative explanation, usually an outside attacker with the account's credentials, by listing what it would leave behind and reporting what was found. State the limits of each source, such as private browsing or stolen session tokens. Cite browser forensics research, a timestamp provenance study and a forensic guide in APA 7.
Inside the AC468 Unit 5 example
The sample names three sources and their time formats, including the Edge store's microseconds since 1601, and notes how the slow firmware clock from Unit 2 is handled. The browser section reports the March 12 registrar checkout and confirmation pages and the March 17 webmail login and inbox pages. The audit section records the message opened at 15:40 UTC and an inbox rule at 15:50 UTC that moved nine genuine supplier messages. Sign-in records show only known locations with multifactor authentication. A six-row findings table follows, with the highlighted sentence explaining why each row names a profile, mailbox or session. The final section shows that outside compromise predicts traces that are absent, then states the limits of private browsing and replayed tokens.
AC468 Unit 5 rubric: what earns full points
This AC468 analysis is graded on correct reading of each source and careful attribution. Points go for identifying storage formats and converting all times to one standard, since findings cannot be ordered otherwise. Graders reward a findings table that aligns sources so corroboration is visible. The highest marks come from testing an alternative explanation properly, stating what it predicts and comparing that with the evidence, rather than dismissing it. Attribution language is checked closely: an analysis that names a person as the actor, when the records identify only an account or profile, loses points. Stated limits, such as private browsing, show judgment. APA 7 references to browser and timestamp research support the method.
AC468 Unit 5 help: mistakes that cost points
Common Unit 5 problems start with time: browser times are left in their stored count or mixed with local times, so the order of events is wrong. Each source is analyzed in its own section and never aligned with the others. Inbox rules are mentioned without explaining their effect on genuine mail. Sign-in records are skipped because nothing suspicious appears, when the absence is itself a finding. The outside-attacker explanation is ignored or waved away. Conclusions say the employee did something, rather than her account or profile. If your section supplied different exports, such as Chrome history or exports from another mail system, a writer can work through those sources with the same attribution care.
Get an AC468 Unit 5 example written to your instructions
History exports or screenshots, any audit or sign-in log extracts, the prompt and the rubric: with those four pieces, Unit 5 activity is rebuilt in UTC and attributed only as far as each source allows. Nothing in the scenario is assumed beyond what the records show. The first custom analysis costs nothing; allow 24-48h. The paper above is an original model document written by our desk, not a submitted student paper and not an official Purdue University Global document.
More AC468 papers and BS in Accounting samples
- AC468 Unit 1: Evidence Admissibility Discussion
- AC468 Unit 2: Evidence Acquisition Record
- AC468 Unit 3: File System Artifact Review
- AC468 Unit 4: Deleted File Recovery Exercise
- AC468 Unit 6: Email Header Trace
- AC468 Unit 7: Timeline Reconstruction
- AC468 Unit 8: Seminar Reflection
- AC468 Unit 9: Electronic Discovery Memo
- AC468 Unit 10: Examination Report
- AC466 Unit 5: Revenue Recognition Red Flag Review
- AC112 Unit 5: Financial Statement Preparation
- AC465 Unit 5: Fraud Investigation Plan
- AC114 Unit 5: Trial Balance and Error Hunt
AC468 Unit 5 questions, answered
Why convert every timestamp to UTC?
Because the sources record time differently. Chromium browsers count microseconds from 1601 in UTC, cloud audit logs usually report UTC, and applications on the laptop may display local time. Converting everything to one reference, with local time shown beside it, is the only way to put a browser visit, an email and a sign-in into a reliable order.
Could an outside attacker have done all of this?
It cannot be ruled out, and the analysis states that plainly. An attacker with the account's credentials and a stolen session could act from a trusted location. What the analysis can do is list what an outside compromise would usually leave, unfamiliar sign-ins, a new device or remote-access software, and report which of those the evidence contains.
Can the analysis use exports from my section's scenario?
Yes. Send the browser history, audit or sign-in extracts your section provides, the prompt and the rubric. Each source is converted to UTC with its native format stated, the findings are aligned in one table, and attribution goes only as far as the records allow, with alternatives argued rather than dismissed.
Where can I find a free AC468 Unit 5 sample paper?
This page holds a full AC468 Unit 5 browser and account activity analysis at Belmonte Fine Foods reading Edge history, mailbox audit records and sign-in logs in UTC, with a findings table, an alternative tested and APA 7 references.
What does the inbox rule show in this analysis?
It moved every message from the supplier's genuine domain into a folder named Archive 2019 and marked it read, so nine real messages, including two payment queries, went unseen. The rule was created in the mailbox twelve minutes after the spoofed message arrived.