Overview 1 page
Lab notes (1 page) and reports (1 page) with using attaching secreenshots.
1. Imaging of a USB drive using Linux tools (2 pages: one lab note and one report)
2. Imaging of a USB drive using Windows tools (2 pages: one lab note and one report)
3. RAM and swap acquisition–live, local computer (2 pages: one lab note and one report)
4. Forensic imaging over a network (2 pages: one lab note and one report)

two-page memo responding to questions about imaging procedures (2 pages)
1. Assuming that this is a criminal case that will be heard in a court of law, which hashing algorithm will you use and why?
2. What if the hash of your original does not match your forensic copy? What kinds of issues could that create? What could cause this situation?
3. What if your OS automatically mounts your flash drive prior to creating your forensic duplicate? What kinds of problems could that create?
4. How will you be able to prove that your OS did not automatically mount your flash drive and change its contents prior to the creation of the forensic copy?