An incident response team is investigating a potential insider threat. An employee is suspected of copying sensitive data to personal cloud storage. Which artifact most directly evidences this activity on a Windows system?
Select an answer to reveal the explanation.
Short Explanation
Here's the deal — you need the artifact set that ties file access to cloud uploads: browser history, LNK files, and Windows Search index entries show sensitive files were accessed, while network logs show large uploads to cloud storage IPs. That's the most direct evidence of copying data to personal cloud storage.
Full Explanation
The browser history, LNK files, and Windows Search index entries combined with network logs showing large uploads to cloud storage IPs is correct because browser history shows cloud storage site visits, LNK (shortcut) files in Recent Items show which files were recently accessed, Windows Search indexes capture file metadata, and network logs showing large HTTPS uploads to cloud service IPs together build a coherent evidentiary picture of data staging and exfiltration. The Windows Security logon event showing the user's logon times is wrong because logon timestamps show when the user was logged in but do not directly evidence file copying or uploads. The Windows Update log showing system changes made by the user is wrong because the Windows Update log tracks OS patches and updates, not user file activity. The user's email archive showing internal communications is wrong because email archives might contain supporting evidence but would not directly evidence file uploads to cloud storage.