{"author_name":"NikoNico","provider_name":"Hatena Blog","provider_url":"https://hatena.blog","image_url":"https://hackmd.io/_uploads/BkgiZdZXbx.png","version":"1.0","categories":["BlueTeamLabsOnline","DFIR","Windows","by k4b1g0n"],"description":"Blue Team Labs Online | Windows Forensics \u672c\u8abf\u67fb\u3067\u306f\u3001Windows \u30a4\u30e1\u30fc\u30b8\u5185\u306b\u5b58\u5728\u3059\u308b VeraCrypt \u30dc\u30ea\u30e5\u30fc\u30e0\u3092\u8d77\u70b9\u306b\u3001\u30af\u30ea\u30c3\u30d7\u30dc\u30fc\u30c9\u5c65\u6b74\u30fb\u30b9\u30c6\u30ac\u30ce\u30b0\u30e9\u30d5\u30a3\u30fb\u6587\u66f8\u89e3\u6790\u3092\u901a\u3057\u3066 \u96a0\u3055\u308c\u305f\u60c5\u5831\u3068\u4e8b\u4ef6\u306e\u5168\u8c8c\u3092\u660e\u3089\u304b\u306b\u3059\u308b\u3002 Q1) What is the full path of the encrypted storage? \u307e\u305a\u3001Windows \u30a4\u30e1\u30fc\u30b8\u5185\u306e\u30e6\u30fc\u30b6\u3092\u78ba\u8a8d\u3002 C:\\Users \u3092\u8abf\u67fb\u3057\u305f\u3068\u3053\u308d\u3001hsalamance \u304c\u30e1\u30a4\u30f3\u30e6\u30fc\u30b6\u3068\u5224\u65ad\u3057\u3001\u4e2d\u3092\u78ba\u8a8d\u3002 \u96a0\u3057\u30d5\u30a1\u30a4\u30eb\u30fb\u30d5\u30a9\u30eb\u30c0\u3092\u8868\u793a\u3057\u3001\u30e6\u30fc\u30b6\u74b0\u5883\u304a\u3088\u3073 Program Files \u914d\u2026","height":"190","blog_url":"https://www.sdsg.moe/","width":"100%","html":"<iframe src=\"https://hatenablog-parts.com/embed?url=https%3A%2F%2Fwww.sdsg.moe%2Fentry%2F2025%2F12%2F31%2F120109\" title=\"BTLO  Writeup  Lola La Chata \u2013 Halloween 23 - Slapdash Safeguards\" class=\"embed-card embed-blogcard\" scrolling=\"no\" frameborder=\"0\" style=\"display: block; width: 100%; height: 190px; max-width: 500px; margin: 10px 0px;\"></iframe>","type":"rich","author_url":"https://blog.hatena.ne.jp/NikoNico/","title":"BTLO  Writeup  Lola La Chata \u2013 Halloween 23","published":"2025-12-31 12:01:09","url":"https://www.sdsg.moe/entry/2025/12/31/120109","blog_title":"Slapdash Safeguards"}