Mini Challenge 3

Digital Corpora ( ) has put together several disk images for education and research. In this (and possibly future) challenges we will investigate
different aspects of one of these images. The “nps-2009-domexusers” image ( available at: ) is a Windows XP
image with two users who communicated with a third user via IM and email. We are interested in finding out more about how these users communicated.

Your Goal:
Analyze the image to discover the email and chat clients that these users may have communicated with.

We will post the solution to Mini-Challenge 3 on 6/7 for you to check how you did. Mini-Challenge 3 solution is available below.

The regripper “uninstall” software plugin lists software installed on the machine based on their presence in the Registry key:

Running this plugin reveals the following:

Email clients:
Microsoft Office Outlook MUI (English) 2007 v.12.0.4518.1014
Mozilla Thunderbird (

Chat clients:
Pidgin v.2.5.2

A screenshot of these answers can be found below.