The Compressed Truth

Scenario

We are provided with Windows Registry hive files to reconstruct deleted evidence.

Q1: CROWQUILL did not break the lock — they took the key while it was still held. A tool was brought for one purpose: extract secrets from memory before they could be put away. What is its name?

A1: KeeFarce

We can open up these files in RegistryExplorer, after looking through the files, we can see vmarr's 7-Zip software. Within that folder, you will find the extraction folder and viewing the data will show the tool used.

Q2: The Registry keeps time as faithfully as it keeps names. The moment CROWQUILL's tool first touched the system is preserved in the artifact. When was the tool extracted? (YYYY-MM-DD hh:mm:ss)

A2: 2026-06-18 13:15:15

Within RegistryExplorer, you will see the last write timestamp for the Extraction folder.

Q3: One archive file caught the operative's eye during enumeration, its contents inspected before staging began. What is the deepest folder that was enumerated inside the archive file?

A3: saltoaths_secretive

Looking at the file manager (FM) of 7-Zip, we can see a folder history section with a lot of data which can be extracted. We can convert the hex to ASCII for better readability and you can see that one folder continues to be enumerated, that is: C:\Users\vmarr\Documents\Registry\oath_records_cinderbound_vol2.zip\. The last folder viewed in the data reveals the answer to this question.

Q4: Before exfiltration comes collection — files pulled from their places and gathered where the operative controls. Where did CROWQUILL stage the stolen records?

A4: c:\users\Public\music\saltwork

Within the same File Manager, we can see the CopyHistory value. This specifically records the folder destination for copied files. saltwork is the only folder that recorded files being copied into.

Q5: The stolen records were compressed and sealed for the journey out — made small enough for channels that do not ask questions. What is the name of the archive prepared for exfiltration?

A5: C:\Users\Public\Pictures\shardchain.tar

Within 7-Zip\Compression, we can find the ArcHistory as it lists archives that are created, this archive is the only one recorded.

Q6: One file above all others — holding keys to every shard, every custodian, every oath. Whoever holds this holds the right to reconstruct authority older than any crown. Where was it stored?

A6: C:\Users\vmarr\Documents\Registry\shard_storage\ShardKeepass_FirstMark\

Checking the folder history again reveals a folder inside the Registry\ folder named shard_storage. The question states there is a file that holds "keys to every shard, every custodian, every oath." The name of the folder ShardKeepass_FirstMark and its location within the registry lets you know what this is the expected place to keep such keys.

Q7: When staging was complete and the archive sealed, the trail ends in one folder — where enumeration stopped. Where did CROWQUILL conclude their operations while using the 7-Zip?

A7: c:\users\vmarr\desktop\working\

FM\PanelPath0 records the last folder that was active in 7-Zip at the time the hive was last written. It is essentially the last place 7-Zip was pointed at.