The Order You Work In

What do you do first?

Work in this order. It is not a style preference: some of these steps destroy the evidence that other steps need.

 1. start from a clean machine
 2. read the ReadMe, write down both account lists
 3. do anything the ReadMe explicitly asks for
 4. forensics questions
 5. accounts
 6. services and installed software
 7. files, permissions, and scheduled jobs
 8. system settings
 9. restart, then re-read the report

Do not worry about what steps 5 through 8 actually mean yet. Each one gets its own unit, and we get to them very soon.

Why forensics come before the cleanup

The forensics questions ask about things you are about to delete.

   you remove the unauthorized account
              │
              ▼
   its name leaves the system,
   and the files it owned now show a number instead
              │
              ▼
   "which account owned that?" is now genuinely hard

Answer first and the questions cost you almost nothing. Clean up first and you are working from memory.

Keep two lists as you work

One for what you found, one for what you fixed. The gap between them is your remaining work, and it is what turns a sudden penalty into a single change to undo.

Try it yourself

Download the worklist below and keep it open next to the machine. It is a list of places to look, in this order, and you will be working from it for the rest of the course.