Task General Info
-----------------------------------------------------------------------------------------------------------------
Will require you to examine a complete disk to determine evidence of a possible crime. Because of the size of the
image and to ensure that you have the facilities to manage a large image 
See the task specification for more details.

The files relating to the PDE source in the task can be found in the Google Drive folder

Please remember to ask any questions for those involved in the incident, the investigation manager,
your external consultant (instructor), or the task setter

--------------------------------------------------------------------------------------------------
For users of the online VMs - the task .dd file should be present in BOTH VMs at 
/files on Linux and C:\Files on Windows. (or so I've been told by tech. support)

The timeouts on the VMs are going to be extended to something in excess of 24 hours from
the current 1 hour to allow for any ingestion filters that you want to run. Please remember 
to destroy your VMs when you're done with them completely, and sleep them if you don't need them running.


Q & A
------

Question Asked:
Since question 1 seems to be quite hands on and doesnt seem to require too much reading around the topic, are we
required to cite anything in it? Apart from showing with evidence from the fragments provided why we are making a 
claim.

Answer Provided:
ACPO principles and ISO/IEC 27042 give some good guidance on what should be in a report. 
Where you rely on published work, or the work of others, you should acknowledge it in some way.