Timeline Analysis of Desktop Property # 0214 207268 HDD

Timeline Analysis of Desktop Property # 0214 207268 HDD Image Z6E8M349.E01 (Device 1) Important Identifiers: User: Michael Thomas Username: BOP19012 SID: S-1-5-21-1823249720-3210992811-1527010081-1102 SID: Microsoft Security Identifier Date Time Action 8/10/2019 0:36:54 User BOP19012 Successfully Logged onto the System 8/10/2019 0:38:36 User launches GroupWise (grpwise.exe) 8/10/2019 0:39:31 User saves/downloads document named "SHU 30 CHECK SHEET (CONDENSED)_1.docx" to location "CAUsers \bop19012 \ Documents \GroupWise 8/10/2019 0:39:31 The "SHU 30 CHECK SHEET (CONDENSED)_1.docx" Word Document is also opened at this time. 8/10/2019 0:40:10 The GroupWise program crashes 8/10/2019 0:40:14 The GroupWise program reloads 8/10/2019 0:43:00 Last Printed timestamp indicates "SHU 30 CHECK SHEET (CONDENSED)_1.docx" was printed 8/10/2019 0:44:19 User saves/downloads document named "SHU Rules Metropolitan Correctional Center New York.docx" to location "CAUsers\