CLOUD
Document with short answers and support with screenshots/paths to source artifact.

Select the CLOUD -> Cloud Google Activity category.
What are three applications that the user used? Facebook, Gmail, Messenger, Skype, sort on the Description Column.
Is there any evidence that the user wants to purchase an owl? Yes, Google Activity has searches related to buying owls.
What is Justine Beaufort’s phone number and date of birth?? 574-404-1921 and 2/18/1990. This information is contained in the Facebook Profile Info.
Has Justine Beaufort ever posted any owl exploitation materials to Facebook? Yes. Facebook Timeline shows two posts of owl materials. Both were on 2/29/2019. One at 8:05:42 and one 8:08:28. On the first post, she commented, “How cute!”
4. Was the user’s Twitter account ever locked out? Yes. In Gmail Messages, there is an email relating that the account is now unlocked.
The document owls.pdf was located in the Justine’s Dropbox account. Where did Justine get that file from? https://wdfw.wa.gov/living/owls.pdf. This is located by conducting a search for owls.pdf and then viewing the records in Google Searches.
6. Did Justine send the document owls.pdf to anyone? Yes, she sent it to Jim Turk on 2/19/2019 5:14:02 via Gmail as an attachment. This is located using Connections