Details:

Suspect "John Doe" has allegedly been hacking public and private websites. We believe he has an accomplice that he may be meeting soon.

After getting a search warrant, first responders collected network traffic and a RAM image of the suspect's live system. Technicians at the lab collected an offline disk image.

All collected suspect data can be found here.

There are three images:

• Windows 10 disk image (15GB)
• Windows 10 RAM image (4.5GB)
• Network traffic acquisition (32MB)

The investigating member is asking the following questions:

• Is there any evidence of website hacking?
• Is there any evidence of a planned meeting? If so, when and where?
• Please provide any user passwords for further analysis.

Remember, proper documentation and reporting are very important! Good luck!

you can download the data for the final here.

There are three images:

• Windows 10 disk image (15GB)
• Windows 10 RAM image (4.5GB)
• Network traffic acquisition (32MB)

Please start downloading from a reliable connection as soon as possible. It is a lot of data, so be sure to process it as soon as you get it.