STRING ANALYSIS AND TARGETED SEARCH COMMANDS

String examination was used alongside Volatility 3 to identify
readable artefacts associated with the controlled ransomware-behaviour
simulation.

The targeted indicators included:

- T1_Simulator.ps1
- Rename-Item
- .locked
- T1_SIMULATED_ENCRYPTED_DATA

Representative targeted search:

grep -Ei "T1_Simulator|Rename-Item|locked" <strings-output-file>

PURPOSE

String analysis supported the identification and comparison of
simulation-related textual artefacts across the acquired memory images,
particularly the T2 PRE, MID and POST acquisition stages.
