Rules of engagement.
On-demand-- that's you.
You can feel free to work alone, with a coworker, with a friend.
You can reach out to the SMEs and see
if anyone else is taking class right now that you
may want to participate with.
But the good news is, you actually
have some additional time to work
through this forensic challenge.
So take your time.
Challenge yourself.
You can ask us instructors specific questions.
Now, the SMEs are trained on the forensic challenge,
so you can always go to them and ask them for specific items,
or you can come directly to Lee and I.
Just leverage our email addresses.
Please put both of us on it when you send us
an email to our Gmail, and we will respond.
Things that you can ask us.
You can ask us for help in a tool.
You can say, I forget how to get into hex view in this tool,
or I forget how to do a hex keyword search.
Feel free to ask us those questions.
What you cannot ask is saying, am I close?
I can't find this file.
I forget which file stores artifact
X. We are going to push you back to your cheat sheets
and your course material to find that.
You can use any tools that you want to work this challenge.
It's totally up to you.
What we are going to expect is, if you think you've solved it,
for you to reach out to us and present us with a presentation.
It should have everything in it that you intend
to use to solve this case.
If you email it to us, if it's good enough, we may just say,
congratulations, you have solved this.
We're going to award you the class coin.
If we have additional questions, we'll send you a Zoom link
and we'll ask you to present it to us.
So don't be overwhelmed if we ask for you to present to us.
Some people actually really want to do that.
If you are in that camp and you really want to present to us,
just tell us that in the email.
There are disqualifiers built into this challenge.
Look at that bottom bullet.
Act wisely.
If you log into something and do not have authority to do so,
you will be disqualified.
We will know that you've done that.
We talked about how all these identifiers happen.
If you want additional access to something,
ask for it before you type.
So if you physically are typing the username and passcode that
does not belong to you, you will be disqualified.