MEMORY ACQUISITION AND INTEGRITY VERIFICATION COMMANDS

Memory acquisition was performed using WinPmem on the running
Windows 10 victim system.

SHA-256 integrity verification was performed following acquisition.

Examples of the integrity verification commands used:

PowerShell:
Get-FileHash -Path "Y:\WIN10_T0_BASELINE.raw" -Algorithm SHA256
Get-FileHash "Y:\WIN10_T1_EARLY.raw" -Algorithm SHA256

SIFT Workstation:
sha256sum ~/cases/T2/evidence/WIN10_T2_PRE.raw
sha256sum ~/cases/T2/evidence/WIN10_T2_MID.raw
sha256sum /mnt/t3share/WIN10_T3_POST.raw
