# Vault 7: Projects

This publication series is about specific projects related to the Vault 7 main publication.

### ExpressLane

# ExpressLane v3.1.1 -- TPP FINAL

24 April, 2009

- 1
- 2
…
- 10
- 11
- 12
- 13
- 14
- 15
- 16

SECRET//20340424
(S/NF) 1. The accessed date and time for the files collected are modified during the
collection process.
(U) Live State Examination
(U) A live state examination was not conducted.
(U) Post-Mortem Examination:
(S/NF) The following artifacts were retrieved from a forensic image of the Subject
following the installation and utilization of the tool:
(U) Subject A: Dell Vostro 200 with Windows XP Professional SP2 64 Bit installed
(S/NF) A1. The tool modifies the accessed date and time for the files collected. Table A2
lists the filenames with modified accessed date and time.
(U) Table A2. Accessed Files
(S/NF) Path: Varies
Name File Created
*.eft 04/24/09 08:31:42 AM – 08:32:59 AM
*.ldf 04/24/09 08:31:42 AM – 08:32:59 AM
*.mdf 04/24/09 08:31:42 AM – 08:32:59 AM
SECRET//20340424
10

- 1
- 2
…
- 10
- 11
- 12
- 13
- 14
- 15
- 16