Forensic Practical #3 - An *excellent* submission

This is a follow up to the Forensic Practical #3

I was contacted via email by Brian Perkins (EnCE) with his answers to Forensic practical #3 I posted a few weeks ago. After reviewing the paper he submitted, I was so impressed that I asked him if I could post it here for others to read and benefit from. Daniel Walton was the first and only person to submit the correct answer to that practical, but Brian's explanation and documentation of his process is very impressive and an excellent reference.

Many thanks to Brian for sharing his knowledge and his process so others can benefit and learn.

You can read his submission here.