1- Which software was used to image the HR Server?
by following the easiest way and luckily the image log is available, we can see it as:
ans: X-Ways Forensics
but you can use many other ways if these logs were not available such as imageinfo, …etc
2- Which version of the software was used to image the HR Server? [Format: n.n]
Following the same approach:
3- What is the file name that represents MFT Entry 168043?
First let’s export the $MFT file