Mini Challenge 3

Scenario:
Digital Corpora ( digitalcorpora.org ) has put together several disk images for education and research. In this (and possibly future) challenges we will investigate
different aspects of one of these images. The “nps-2009-domexusers” image ( available at:http://digitalcorpora.org/corp/nps/drives/nps-2009-domexusers/ ) is a Windows XP
image with two users who communicated with a third user via IM and email. We are interested in finding out more about how these users communicated.

Your Goal:
Analyze the image to discover the email and chat clients that these users may have communicated with.

Solution:
We will post the solution to Mini-Challenge 3 on 6/7 for you to check how you did. Mini-Challenge 3 solution is available below.

Solution
The regripper “uninstall” software plugin lists software installed on the machine based on their presence in the Registry key:
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Uninstall

Running this plugin reveals the following:

Email clients:
Microsoft Office Outlook MUI (English) 2007 v.12.0.4518.1014
Mozilla Thunderbird (2.0.0.17)

Chat clients:
AIM 6
Pidgin v.2.5.2

A screenshot of these answers can be found below.