The BTK Killer (2004) — Windows Registry & MFT Metadata

Police found a floppy disk used by Dennis Rader (BTK). They extracted Microsoft Word metadata from a deleted document revealing the last author was 'Dennis' on a church computer.

## Background

Police found a floppy disk used by Dennis Rader (BTK). They extracted Microsoft Word metadata from a deleted document revealing the last author was 'Dennis' on a church computer.

## Learning Objective
Extract timeline artifacts from Windows registry, event viewer (EVTX), and user-assist keys.

## Scenario
You are the lead digital forensic investigator assigned to this case. Based on the real-world events described, you must analyze the available evidence, reconstruct the timeline, and produce a forensic report.

### Key Facts
- Case: The BTK Killer (2004) — Windows Registry & MFT Metadata
- Year: 2004
- Domain: Cyber Forensics
- Difficulty: Advanced

## Evidence Available

Refer to the dataset at: https://github.com/arora200/aplly_case_db/tree/main/datasets/fss303-btk-killer

## Investigation Questions

1. How did investigators recover deleted Word document metadata from the floppy disk?
2. What MFT attributes store file timestamps and how do they differ?
3. Why can't regular users easily forge $STANDARD_INFORMATION timestamps?
4. What Windows Registry keys would you examine in a similar investigation?
5. Reconstruct the timeline of the BTK floppy disk based on MFT artifacts.

## Deliverables

1. Forensic Report — Document your findings, methodology, and conclusions
2. Timeline Reconstruction — Map the sequence of events
3. Evidence Log — Document all evidence collected with hash values
4. Legal Admissibility Checklist — Ensure your evidence meets evidentiary standards

## Expert Insight
In Windows, the OS tells you who did it, when they did it, and which USB drive they used. The Registry is a crime scene within a crime scene.

## Forensic Takeaway
Windows file systems store MFT entries. $FILE_NAME and $STANDARD_INFORMATION timestamps cannot be easily forged by regular users.