all of the things

26 files changed, 1114 insertions, 0 deletions

diff --git a/.new_assignment_prompt.md b/.new_assignment_prompt.md
new file mode 100644
index 0000000..48c8553
--- /dev/null
+++ b/.new_assignment_prompt.md
@@ -0,0 +1,109 @@
+Act as a markdown-to-HTML converter for study assignments. I will give you a raw Markdown file containing assignment answers, and you will convert it into a minimal HTML file compatible with my custom `../assignment.js` template.
+
+### Input Types to Support:
+1. **Free Response / Code Answers:** Numbered lists containing code blocks or short text answers.
+2. **Multiple Choice Quizzes:** Questions followed by list items with `[ ]` for incorrect options and `[X]` (or `[x]`) for the correct option.
+
+### Conversion Rules:
+* **Title:** Extract the top header (`# Header Title`) and place it inside the `<title>` tag.
+* **Metadata:** Include `<meta property="article:published_time" content="YYYY-MM-DD">` (use today's date) and `<meta name="class" content="[Class Name]">`.
+  - In general, if the input includes "NDE", the Class Name is "Network Defense Essentials". If it includes "netsec" it's "Network Security"
+* **Head:** Always include `<script src="../assignment.js" defer></script>`. Do not include external CSS links or script logic, as `../assignment.js` injects metadata, head links, and the header layout dynamically.
+* **Header:** Leave `<header></header>` empty directly inside `<body>`.
+* **Main Container:** Wrap the actual content in `<main>`.
+* **Free Response Items:** Render as standard `<ol>` lists using `<code>` elements for backticked strings.
+* **Multiple Choice Items:** Render as `<ol class="quiz-list">`. Wrap the options in `<ul class="options">`.
+* Unchecked options (`[ ]`) should be rendered as standard `<li>` elements.
+* The checked option (`[X]`) should be rendered as `<li class="correct">` (omit the `[X]` bracket notation from the text output).
+
+---
+
+### Example Input 1 (Free Response):
+```markdown
+# NDE Lab 1
+1. `S-1-5-21-3504108470-3217663453-2648748712-500`
+2. `4`
+3. `-R`
+4. `10.0.14393`
+
+```
+
+### Example Output 1:
+```html
+<!DOCTYPE html>
+<html lang="en">
+<head>
+  <title>NDE Lab 1</title>
+  <meta property="article:published_time" content="2026-08-21">
+  <meta name="class" content="Network Defense Essentials">
+  <script src="../assignment.js" defer></script>
+</head>
+<body>
+  <header></header>
+  <main>
+    <ol>
+      <li><code>S-1-5-21-3504108470-3217663453-2648748712-500</code></li>
+      <li><code>4</code></li>
+      <li><code>-R</code></li>
+      <li><code>10.0.14393</code></li>
+    </ol>
+  </main>
+</body>
+</html>
+```
+
+---
+
+### Example Input 2 (Multiple Choice):
+```markdown
+# Week 1: Quiz 1
+1. Which of the following IA principles is crucial for identifying users/accounts and preventing unauthorized access to resources?
+- [ ] Integrity
+- [ ] Availability
+- [ ] Non-repudiation
+- [X] Authentication
+
+2. Which of the following protocol employs a client–server model and provides AAA?
+- [ ] SMTP
+- [ ] HTTPS
+- [ ] IPsec
+- [X] RADIUS
+```
+
+### Example Output 2:
+```html
+<!DOCTYPE html>
+<html lang="en">
+<head>
+  <title>Week 1: Quiz 1</title>
+  <meta property="article:published_time" content="2026-08-21">
+  <meta name="class" content="Network Defense Essentials">
+  <script src="../assignment.js" defer></script>
+</head>
+<body>
+  <header></header>
+  <main>
+    <ol class="quiz-list">
+      <li>
+        <p>Which of the following IA principles is crucial for identifying users/accounts and preventing unauthorized access to resources?</p>
+        <ul class="options">
+          <li>Integrity</li>
+          <li>Availability</li>
+          <li>Non-repudiation</li>
+          <li class="correct">Authentication</li>
+        </ul>
+      </li>
+      <li>
+        <p>Which of the following protocol employs a client–server model and provides AAA?</p>
+        <ul class="options">
+          <li>SMTP</li>
+          <li>HTTPS</li>
+          <li>IPsec</li>
+          <li class="correct">RADIUS</li>
+        </ul>
+      </li>
+    </ol>
+  </main>
+</body>
+</html>
+```
diff --git a/CHFI1/final.md b/CHFI1/final.md
new file mode 100644
index 0000000..69aac6e
--- /dev/null
+++ b/CHFI1/final.md
@@ -0,0 +1,149 @@
+1. Which of the following processes involves the technical methods and organizational measures for discovering, tracing, and inculpating individuals or groups responsible for cyberattacks?
+  - [ ] Physical acquisition
+  - [ ] eDiscovery
+  - [X] Cyber Attribution
+  - [ ] Data recovery
+ 
+2. Xavier, a forensic expert, was investigating a cyber incident. He started the investigation by collecting and analyzing information from a suspected device at the crime scene. He identified that the attacker hid their IP address using proxies and used a fake identity for communication. Which of the following challenges of cybercrime is demonstrated in the above scenario?
+  - [ ] Limited legal understanding
+  - [ ] Speed
+  - [X] Anonymity
+  - [ ] Evidence size and complexity
+ 
+3. Which of the following techniques best describes an organization’s ability to optimally use digital evidence in a limited time and with minimal investigation costs? 
+  - [ ] Chain of custody
+  - [X] Forensic readiness
+  - [ ] Vulnerability assessment
+  - [ ] Trial obfuscation
+ 
+4. In which of the following steps of forensic readiness planning do investigators determine what currently happens to potential evidence data and the impact on the business while retrieving the information?
+  - [ ] Identify the potential evidence required for an incident.
+  - [X] Determine the sources of evidence.
+  - [ ] Establish a policy for securely handling and storing the collected evidence.
+  - [ ] Keep an incident response team ready to review the incident and preserve the evidence.
+ 
+5. Which of the following practices indicates that an organization is not forensically prepared to maintain business continuity?
+  - [ ] Minimize the required resources
+  - [ ] Legally persecute the perpetrators and claim damages
+  - [ ] Quickly determine the incidents
+  - [X] Inability to collect legally sound evidence
+ 
+6. Williams, a forensic specialist, was investigating a system suspected to be involved in a cybercrime. Williams collected the required evidence, eliminated the root cause of the incident, and closed all the attack vectors to prevent similar incidents in the future.In which of the following phases of incident response did Williams perform the above tasks? 
+  - [X] Eradication
+  - [ ] Preparation for incident handling and response
+  - [ ] Incident triage
+  - [ ] Post-incident activities
+ 
+7. Which of the following terms refers to the principles used to describe the expected behavior of an investigator while handling a case?
+  - [ ] System baselining
+  - [X] Code of ethics
+  - [ ] Lawful interception
+  - [ ] Tactics, techniques, and procedures
+ 
+8. Identify the type of data acquisition technique in which an investigator can collect volatile data from suspected devices only when the device is powered on.
+  - [ ] Static acquisition
+  - [ ] Dead acquisition
+  - [X] Live acquisition
+  - [ ] Non-volatile acquisition
+ 
+9. Which of the following types of data is considered the most volatile according to the RFC 3227 guidelines for evidence collection and archiving?
+  - [X] Registers and processor cache
+  - [ ] Physical configuration
+  - [ ] Archival media
+  - [ ] Network topology
+ 
+10. Thomas, a forensics specialist, was resolving a case related to fake email broadcasting. Thomas retrieved data from the victim system for analysis to find the source of the email server. For this purpose, Thomas extracted only “.ost” files from the system as they can provide the required information about the incident. Identify the type of data acquisition performed by Thomas in the above scenario.
+  - [ ] Sparse acquisition
+  - [ ] Bit-stream disk-to-image-file
+  - [ ] Bit-stream disk-to-disk
+  - [X] Logical acquisition
+ 
+11. Which of the following techniques refers to a backup program an investigator should have in case hardware or software does not work or there is any failure during an acquisition?
+  - [ ] Data duplication
+  - [ ] Chain of custody
+  - [X] Plan for contingency
+  - [ ] Data analysis
+ 
+12. In which of the following forensic data acquisition steps do the investigators overwrite the data by applying a code of sequential zeros or ones to protect it from recovery?
+  - [ ] Validating data acquisition
+  - [X] Sanitize the target media
+  - [ ] Acquiring volatile data
+  - [ ] Planning for contingency
+ 
+13. Which of the following is a program that allows bundling all files together into a single executable file via compression to bypass security software detection?
+  - [ ] Dropper
+  - [ ] Obfuscator
+  - [ ] Payload
+  - [X] Packer
+ 
+14. Jude, a forensic expert, presented the final report of all his evidence findings related to a criminal case. Further, Jude provided supporting documents with details, including the source and author of the evidence and path of transmission involved in the case, to ensure that no piece of evidence was missed. Which of the following rules of evidence is demonstrated in the above scenario?
+  - [ ] Admissible
+  - [ ] Understandable
+  - [ ] Complete
+  - [X] Authentic
+ 
+15. Which of the following sections of the (ACPO) Principles of Digital Evidence states that no action taken by law enforcement agencies, persons employed within those agencies, or their agents should change data that may subsequently be relied upon in court?
+  - [ ] Principle 2
+  - [ ] Principle 4
+  - [ ] Principle 3
+  - [X] Principle 1
+ 
+16. James, a forensic investigator, was tasked with identifying and seizing the electronic devices at a crime scene. For this purpose, James obtained documented permission from the owner of the target electronic device to perform a thorough investigation. Identify the activity performed by James during the investigation. 
+  - [X] Seeking consent
+  - [ ] Searches without a warrant
+  - [ ] Obtaining witness signatures
+  - [ ] Obtaining a warrant for search and seizure
+ 
+17. Which of the following is a legal document that demonstrates the progression of evidence as it travels from the original evidence location to the forensic laboratory? 
+  - [X] Chain of custody
+  - [ ] Witness signature
+  - [ ] Search warrant
+  - [ ] Seeking consent
+ 
+18. When handling evidence related to Internet usage, investigators must preserve the anonymity of other users. Which of the following issues does the above statement describe?
+  - [X] Privacy issues
+  - [ ] Environmental issues
+  - [ ] Legal issues
+  - [ ] Infrastructure issues
+ 
+19. Identify the ISO standard that deals with electronic discovery activities such as identifying, preserving, collecting, processing, reviewing, analyzing, and producing electronically processed information (ESI).
+  - [ ] ISO/IEC 27043
+  - [ ] ISO/IEC 27041
+  - [X] ISO/IEC 27050
+  - [ ] ISO/IEC 27042
+ 
+20. Which of the following components of an SSD is volatile memory, requires power to retain data, and is included to increase the read/write performance of the SSD? 
+  - [ ] Host interface
+  - [ ] Controller
+  - [ ] NAND flash memory
+  - [X] DRAM
+ 
+21. Which stage in the booting process of a Linux system establishes a temporary root file system using the initial RAM disk (initrd) until the real file system is mounted?
+  - [ ] Bootloader stage
+  - [ ] BIOS stage
+  - [ ] Grand unified bootloader (GRUB) stage
+  - [X] Kernel stage
+ 
+22. In which of the following phases of the computer forensics investigation methodology must the investigator take a photograph of the computer monitor’s screen and note down what was observed on the screen? 
+  - [X] Documenting the electronic crime scene
+  - [ ] Evidence preservation
+  - [ ] Data acquisition
+  - [ ] Search and seizure
+ 
+23. Which of the following commands allows investigators to mount an image in the APFS format and view its contents on a Linux system?
+  - [X] losetup
+  - [ ] wevtutil
+  - [ ] fsutil
+  - [ ] strings
+ 
+24. Identify the dcfldd command that investigators use to compare an image file to the original medium, such as a drive or partition. 
+  - [X] dcfldd if=/dev/sda vf=image.dd
+  - [ ] dcfldd if=/dev/sda of=usbimg.dat
+  - [ ] dcfldd if=/dev/sda split=2M of=usbimg hash=md5 hashlog=usbhash.log
+  - [ ] dd if=/dev/sdb | split –b 650m - image_sdb
+ 
+25. Which of the following is a pre-installed command-line utility in Linux systems for scheduling commands, scripts, tasks, or jobs to execute at a specific time or for a repeated duration?
+  - [ ] ListDLLs
+  - [ ] nbtstat
+  - [ ] ipconfig
+  - [X] Cron
diff --git a/CHFI1/index.html b/CHFI1/index.html
new file mode 100644
index 0000000..f9d117d
--- /dev/null
+++ b/CHFI1/index.html
@@ -0,0 +1,46 @@
+<!DOCTYPE html>
+<html>
+	<head>
+		<title>CHFI1</title>
+	</head>
+	<body>
+		<h2>Week 1</h2>
+		<ul>
+			<li><a href="./wk1_lab1.md">Lab</a></li>
+			<li><a href="./wk1_quiz1.md">Quiz</a></li>
+		</ul>
+
+		<h2>Week 2</h2>
+		<ul>
+			<li><a href="wk2_lab1.md">Lab</a></li>
+			<li><a href="wk2_quiz1.md">Quiz</a></li>
+		</ul>
+
+		<h2>Week 3</h2>
+		<ul>
+			<li><a href="wk3_lab1.md">Lab 1</a></li>
+			<li><a href="wk3_lab2.md">Lab 2</a></li>
+			<li><a href="wk3_quiz1.md">Quiz</a></li>
+		</ul>
+
+		<h2>Week 4</h2>
+		<ul>
+			<li><a href="wk4_lab1.md">Lab</a></li>
+			<li><a href="wk4_quiz1.md">Quiz</a></li>
+		</ul>
+
+		<h2><a href="midterm.md">Midterm</a></h2>
+
+		<h2>Week 5</h2>
+		<ul>
+			<li><a href="wk5_quiz1.md">Quiz</a></li>
+		</ul>
+
+		<h2>Week 6</h2>
+		<ul>
+			<li><a href="wk6_lab1.md">Lab</a></li>
+		</ul>
+
+		<h2><a href="final.md">Final</a></h2>
+	</body>
+</html>
diff --git a/CHFI1/midterm.md b/CHFI1/midterm.md
new file mode 100644
index 0000000..8ea906e
--- /dev/null
+++ b/CHFI1/midterm.md
@@ -0,0 +1,120 @@
+1. Which of the following processes involves the technical methods and organizational measures for discovering, tracing, and inculpating individuals or groups responsible for cyberattacks?
+  - [X] Cyber Attribution
+  - [ ] Data recovery
+  - [ ] Physical acquisition
+  - [ ] eDiscovery
+ 
+2. Which of the following techniques best describes an organization’s ability to optimally use digital evidence in a limited time and with minimal investigation costs? 
+  - [ ] Trial obfuscation
+  - [ ] Vulnerability assessment
+  - [ ] Chain of custody
+  - [X] Forensic readiness
+ 
+3. In which of the following steps of forensic readiness planning do investigators determine what currently happens to potential evidence data and the impact on the business while retrieving the information? 
+  - [ ] Identify the potential evidence required for an incident.
+  - [X] Determine the sources of evidence.
+  - [ ] Establish a policy for securely handling and storing the collected evidence.
+  - [ ] Keep an incident response team ready to review the incident and preserve the evidence.
+ 
+4. Which of the following practices indicates that an organization is not forensically prepared to maintain business continuity?
+  - [ ] Quickly determine the incidents
+  - [ ] Minimize the required resources
+  - [X] Inability to collect legally sound evidence
+  - [ ] Legally persecute the perpetrators and claim damages
+ 
+5. Which of the following AI techniques can assist the forensic investigators in performing sentiment analysis, topic modeling, and identifying suspicious or relevant conversations on communication records?
+  - [ ] Image and video analysis
+  - [ ] Expert systems
+  - [X] Natural language processing
+  - [ ] Reasoning process
+ 
+6.  Which of the following techniques involves the analysis of logs to detect and study an incident that may have already occurred in a network or device?
+  - [X] Postmortem
+  - [ ] Steganalysis
+  - [ ] Social engineering
+  - [ ] Cryptanalysis
+ 
+7. Which of the following terms refers to the principles used to describe the expected behavior of an investigator while handling a case?
+  - [X] Code of ethics
+  - [ ] Tactics, techniques, and procedures
+  - [ ] System baselining
+  - [ ] Lawful interception
+ 
+8. Identify the type of data acquisition technique in which an investigator can collect volatile data from suspected devices only when the device is powered on.
+  - [ ] Dead acquisition
+  - [X] Live acquisition
+  - [ ] Static acquisition
+  - [ ] Non-volatile acquisition
+ 
+9. Which of the following types of data is considered the most volatile according to the RFC 3227 guidelines for evidence collection and archiving?
+  - [ ] Physical configuration
+  - [ ] Network topology
+  - [ ] Archival media
+  - [X] Registers and processor cache
+ 
+10. Which of the following techniques refers to a backup program an investigator should have in case hardware or software does not work or there is any failure during an acquisition?
+  - [ ] Data duplication
+  - [X] Plan for contingency
+  - [ ] Chain of custody
+  - [ ] Data analysis
+ 
+11. In which of the following forensic data acquisition steps do the investigators overwrite the data by applying a code of sequential zeros or ones to protect it from recovery?
+  - [ ] Planning for contingency
+  - [ ] Acquiring volatile data
+  - [X] Sanitize the target media
+  - [ ] Validating data acquisition
+ 
+12. Which of the following is a program that allows bundling all files together into a single executable file via compression to bypass security software detection?
+  - [ ] Obfuscator
+  - [X] Packer
+  - [ ] Payload
+  - [ ] Dropper
+ 
+13. Which of the following sections of the (ACPO) Principles of Digital Evidence states that no action taken by law enforcement agencies, persons employed within those agencies, or their agents should change data that may subsequently be relied upon in court?
+  - [ ] Principle 3
+  - [ ] Principle 4
+  - [X] Principle 1
+  - [ ] Principle 2
+ 
+14. Which of the following federal rules of evidence stipulates that “rules should be construed so as to administer every proceeding fairly, eliminating unjustifiable expense and delay, and promoting the development of evidence law, to the end of ascertaining the truth and securing a just determination”?
+  - [ ] Rule 1003. Admissibility of duplicates
+  - [X] Rule 102: Purpose
+  - [ ] Rule 801: Hearsay rule
+  - [ ] Rule 105: Limited admissibility
+ 
+15. Which of the following eDiscovery team members performs the deployment of tools on a suspected computer machine and configures, implements, and maintains the deployed tools?
+  - [ ] eDiscovery Attorney
+  - [X] eDiscovery Software Expert
+  - [ ] IT Support Personnel
+  - [ ] Processing/Review Personnel
+ 
+16. Which of the following types of acknowledgement is required from an individual who is present while obtaining a documented agreement and who testifies that the parties mentioned in the agreement have voluntarily accepted the agreement?
+  - [ ] Obtaining a warrant for search and seizure
+  - [X] Obtaining witness signatures
+  - [ ] Seeking consent
+  - [ ] Searches without a warrant
+ 
+17. Which of the following is a legal document that demonstrates the progression of evidence as it travels from the original evidence location to the forensic laboratory? 
+  - [ ] Search warrant
+  - [X] Chain of custody
+  - [ ] Witness signature
+  - [ ] Seeking consent
+ 
+18. Which of the following issues in computer forensics might arise because of the improper handling of evidence during an investigation, making the evidence inadmissible in a court of law?
+  - [ ] Infrastructure issues
+  - [ ] Legal jurisdiction issues
+  - [X] Legal issues
+  - [ ] Privacy issues
+ 
+19. Which of the following is a proprietary information security standard for organizations that handle cardholder information for major debit, credit, prepaid, e-purse, ATM, and POS cards?
+  - [X] PCI DSS
+  - [ ] GLBA
+  - [ ] FISMA
+  - [ ] SOX
+ 
+20. Identify the ISO standard that provides recommendations for specific activities in handling digital evidence, such as the identification, collection, acquisition, and preservation of digital evidence.
+  - [ ] ISO/IEC 27041
+  - [X] ISO/IEC 27037
+  - [ ] ISO/IEC 27050
+  - [ ] ISO/IEC 27042
+
diff --git a/CHFI1/wk1_index.html b/CHFI1/wk1_index.html
new file mode 100644
index 0000000..e007432
--- /dev/null
+++ b/CHFI1/wk1_index.html
@@ -0,0 +1,12 @@
+<!DOCTYPE html>
+<html>
+  <head>
+    <title>Section 1</title>
+  </head>
+  <body>
+    <ul>
+      <li><a href="lab1.md">Lab 1</a></li>
+      <li><a href="quiz1.md">Quiz 1</a></li>
+    </ul>
+  </body>
+</html>
diff --git a/CHFI1/wk1_lab1.md b/CHFI1/wk1_lab1.md
new file mode 100644
index 0000000..8f56b3f
--- /dev/null
+++ b/CHFI1/wk1_lab1.md
@@ -0,0 +1,6 @@
+1. 52
+2. c37ae9efc4eefcf1fe9cefa69a9e51f4
+3. 3c32
+4. 105
+5. 24
+6. C-image.rdr
diff --git a/CHFI1/wk1_quiz1.md b/CHFI1/wk1_quiz1.md
new file mode 100644
index 0000000..cbf0339
--- /dev/null
+++ b/CHFI1/wk1_quiz1.md
@@ -0,0 +1,30 @@
+1. Which of the following terms refers to an internal investigation by an organization to discover if its employees, clients, and partners are abiding by the rules or policies?
+  - [ ] Criminal investigation
+  - [X] Administrative investigation
+  - [ ] Cybercrime investigation
+  - [ ] Civil investigation
+
+2. In which of the following phases of the incident response process do investigators analyze, validate, and prioritize an incident?
+  - [ ] Preparation for incident handling and response
+  - [ ] Eradication
+  - [ ] Containment
+  - [X] Incident triage
+
+3. Which of the following tasks should be performed if a system/network administrator acts as a first responder?
+  - [X] Transfer copies of system logs onto a clean media
+  - [ ] Allow tampering of computing systems present at the scene
+  - [ ] If an ongoing attack is detected, immediately power down the computing systems
+  - [ ] Do not document the details relevant to the incident
+
+4. Which of the following terms refers to the process of examining, identifying, separating, converting, and modeling data to isolate useful information?
+  - [ ] Data visualization
+  - [X] Data analysis
+  - [ ] Data duplication
+  - [ ] Data recovery
+
+5. Which of the following forensics investigation report sections includes the tools and techniques used for collecting evidence during the investigation?
+  - [ ] Investigation process
+  - [X] Evidence information
+  - [ ] Executive summary
+  - [ ] Evaluation and analysis process
+
diff --git a/CHFI1/wk2_lab1.md b/CHFI1/wk2_lab1.md
new file mode 100644
index 0000000..3148058
--- /dev/null
+++ b/CHFI1/wk2_lab1.md
@@ -0,0 +1,6 @@
+1. /etc/network/interfaces
+2. istat -f ntfs "E:\CHFI-Tools\Evidence Files\Forensic Images\Windows_Evidence_001.dd" 1
+3. 4 KB
+4. fls -m 63 "E:\CHFI-Tools\Evidence Files\Forensic Images\Windows_Evidence_001.dd" > body.txt
+5. 25 50 44 46
+
diff --git a/CHFI1/wk2_quiz1.md b/CHFI1/wk2_quiz1.md
new file mode 100644
index 0000000..3a245dd
--- /dev/null
+++ b/CHFI1/wk2_quiz1.md
@@ -0,0 +1,30 @@
+1. Which of the following is the wasted area of a disk cluster lying between the end of a file and the end of the cluster and is created when the file system allocates a full cluster to a file smaller than the cluster size?
+  - [X] Slack Space
+  - [ ] Platter
+  - [ ] Cluster
+  - [ ] Track
+ 
+2. Identify the formula for calculating disk capacity using parameters such as the total number of LBAs and block size.
+  - [ ] Disk Capacity (in bytes) = Total Number of LBAs + Block Size
+  - [ ] Disk Capacity (in bytes) = Total Number of LBAs / Block Size
+  - [X] Disk Capacity (in bytes) = Total Number of LBAs * Block Size
+  - [ ] Disk Capacity (in bytes) = Total Number of LBAs - Block Size
+ 
+3. Which of the following elements is a 128-bit unique number generated by Windows OS to identify a specific device, a document, a database entry, and/or the user?
+  - [ ] Master boot record (MBR)
+  - [ ] Slack space
+  - [X] Globally unique identifier (GUID)
+  - [ ] BIOS parameter block (BPB)
+ 
+4. Identify the part in the MBR structure located at the end of the MBR, holds only 2 bytes of data, and is required by BIOS during booting.
+  - [ ] Boot strap
+  - [ ] Partition table
+  - [ ] Master boot code
+  - [X] Disk signature
+ 
+5. Which of the following components of the Apple File System (APFS) stores information about metadata structures?
+  - [ ] Extents B-tree
+  - [ ] Bitmap structures
+  - [X] Checkpoint superblock descriptor (CSBD)
+  - [ ] Checkpoints
+
diff --git a/CHFI1/wk3_lab1.md b/CHFI1/wk3_lab1.md
new file mode 100644
index 0000000..c735277
--- /dev/null
+++ b/CHFI1/wk3_lab1.md
@@ -0,0 +1,6 @@
+1. xmount --in ewf Windows_Evidence_001.E01 /home/jason/Documents
+2. 8
+3. dd if=/dev/fmem of=/home/james/Documents/test_ram.dd bs=1MB
+4. NTFS
+5. 346849
+6. disk_analysis.py
diff --git a/CHFI1/wk3_lab2.md b/CHFI1/wk3_lab2.md
new file mode 100644
index 0000000..d5567a2
--- /dev/null
+++ b/CHFI1/wk3_lab2.md
@@ -0,0 +1,11 @@
+1. 75
+2. 52b29a36da797ff3c4c9fed18140176b
+3. To be Removed (NTFS)
+4. Detailed (Scan progress and found objects. Slower.)
+5. Admin:1001:A51FF92044FF4D13E52680FD0791DD5E:0861202B9BD0F6E918ACA597EAE28281 : : :
+6. By2
+7. 103431
+8. Microsoft.PowerShell.Core\FileSystem::C:\Windows\system32
+9. application/x-msoffice
+10. UPX1
+
diff --git a/CHFI1/wk3_quiz1.md b/CHFI1/wk3_quiz1.md
new file mode 100644
index 0000000..342ed36
--- /dev/null
+++ b/CHFI1/wk3_quiz1.md
@@ -0,0 +1,6 @@
+1. Which of the following techniques is the process of recovering files from their fragments and
+pieces from unallocated space of the hard disk in the absence of file system metadata?
+  - [X] File carving
+  - [ ] Steganography
+  - [ ] File encryption
+  - [ ] Cryptography
diff --git a/CHFI1/wk4_lab1.md b/CHFI1/wk4_lab1.md
new file mode 100644
index 0000000..33ccf63
--- /dev/null
+++ b/CHFI1/wk4_lab1.md
@@ -0,0 +1,10 @@
+1. 6771
+2. 1840
+3. 5.8.17
+4. Data Inspector
+5. chromehistoryview
+6. Ubuntu Server
+7. 192
+8. 201665
+9. 24bit
+10. S-1-5-18
diff --git a/CHFI1/wk4_quiz1.md b/CHFI1/wk4_quiz1.md
new file mode 100644
index 0000000..d83ef65
--- /dev/null
+++ b/CHFI1/wk4_quiz1.md
@@ -0,0 +1,29 @@
+1. Which of the following netstat switches will display details of the TCP and UDP network connections, including listening ports and the identifiers?
+  - [ ] -r switch
+  - [ ] -s switch
+  - [X] -ano switch
+  - [ ] -o switch
+
+2. Identify the tasklist parameter that lists all the service information for each process without truncation.
+  - [ ] /u
+  - [ ] /s
+  - [X] /svc
+  - [ ] /v
+
+3. Which of the following technologies is referred to as JET Blue that stores and manages main records pertaining to systems and users in Windows OS?
+  - [ ] Slack Space
+  - [ ] Windows Search Index
+  - [ ] Volume Shadow Copy Service
+  - [X] Extensible Storage Engine
+
+4. Identify the Window Registry hive that contains file extension association information and programmatic identifier (ProgID), class ID (CLSID), and interface ID (IID) data.
+  - [ ] HKEY_LOCAL_MACHINE
+  - [ ] HKEY_CURRENT_CONFIG
+  - [X] HKEY_CLASSES_ROOT
+  - [ ] HKEY_USERS
+
+5. Identify the type of cell in the Windows Registry structure that comprises a series of indexes pointing to the parent key cell.
+  - [ ] Value cell
+  - [ ] Security descriptor cell
+  - [ ] Value list cell
+  - [X] Subkey list cell
diff --git a/CHFI1/wk5_quiz1.md b/CHFI1/wk5_quiz1.md
new file mode 100644
index 0000000..c3a6211
--- /dev/null
+++ b/CHFI1/wk5_quiz1.md
@@ -0,0 +1,6 @@
+1. Which of the following EnablePrefetcher values indicates that “Application prefetching is enabled”?
+Group of answer choices
+  - [ ] 3
+  - [X] 1
+  - [ ] 0
+  - [ ] 2
diff --git a/CHFI1/wk6_lab1.md b/CHFI1/wk6_lab1.md
new file mode 100644
index 0000000..9907fd8
--- /dev/null
+++ b/CHFI1/wk6_lab1.md
@@ -0,0 +1,4 @@
+1. 0
+2. last -f /var/log/wtmp
+3. c2460ce1b6c33da7af5e4d0043cfd22a
+4. python3 vol.py -f /home/jason/Linux.mem linux.pslist
diff --git a/NDE/wk1_lab1.html b/NDE/wk1_lab1.html
new file mode 100644
index 0000000..5a1c4db
--- /dev/null
+++ b/NDE/wk1_lab1.html
@@ -0,0 +1,21 @@
+<!DOCTYPE html>
+<html lang="en">
+	<head>
+		<title>NDE Lab 1</title>
+		<meta property="article:published_time" content="2026-08-21">
+		<meta name="class" content="Network Defense Essentials">
+		<script src="../assignment.js" defer></script>
+	</head>
+	<body>
+		<header></header>
+
+		<main>
+			<ol>
+				<li><code>S-1-5-21-3504108470-3217663453-2648748712-500</code></li>
+				<li><code>4</code></li>
+				<li><code>-R</code></li>
+				<li><code>10.0.14393</code></li>
+			</ol>
+		</main>
+	</body>
+</html>
diff --git a/NDE/wk1_quiz1.html b/NDE/wk1_quiz1.html
new file mode 100644
index 0000000..35d5a15
--- /dev/null
+++ b/NDE/wk1_quiz1.html
@@ -0,0 +1,47 @@
+<!DOCTYPE html>
+<html lang="en">
+	<head>
+		<title>Week 1: Quiz 1</title>
+		<meta property="article:published_time" content="2026-08-21">
+		<meta name="class" content="Network Defense Essentials">
+		<script src="../assignment.js" defer></script>
+	</head>
+	<body>
+
+		<header></header>
+
+		<main>
+			<ol class="quiz-list">
+				<li>
+					<p>Which of the following IA principles is crucial for identifying users/accounts and preventing unauthorized access to resources?</p>
+					<ul class="options">
+						<li>Integrity</li>
+						<li>Availability</li>
+						<li>Non-repudiation</li>
+						<li class="correct">Authentication</li>
+					</ul>
+				</li>
+
+				<li>
+					<p>Which of the following protocol employs a client–server model and provides authentication, authorization, and accounting (AAA) for remote-access servers to communicate with a central server?</p>
+					<ul class="options">
+						<li>SMTP</li>
+						<li>HTTPS</li>
+						<li>IPsec</li>
+						<li class="correct">RADIUS</li>
+					</ul>
+				</li>
+
+				<li>
+					<p>Which of the following authentication mechanisms provides cryptography-based authentication using a small computer chip that stores the user’s personal information for identification?</p>
+					<ul class="options">
+						<li class="correct">Smart card authentication</li>
+						<li>Two-factor authentication</li>
+						<li>Single sign-on (SSO) authentication</li>
+						<li>Password authentication</li>
+					</ul>
+				</li>
+			</ol>
+		</main>
+	</body>
+</html>
diff --git a/NDE/wk2_lab1.html b/NDE/wk2_lab1.html
new file mode 100644
index 0000000..5595d49
--- /dev/null
+++ b/NDE/wk2_lab1.html
@@ -0,0 +1,17 @@
+<!DOCTYPE html>
+<html lang="en">
+<head>
+  <title>NDE Lab 2</title>
+  <meta property="article:published_time" content="2026-08-25">
+  <meta name="class" content="Network Defense Essentials">
+  <script src="../assignment.js" defer></script>
+</head>
+<body>
+  <header></header>
+  <main>
+    <ol>
+      <li><code>martin@nde.com</code></li>
+    </ol>
+  </main>
+</body>
+</html>
diff --git a/NDE/wk2_quiz1.html b/NDE/wk2_quiz1.html
new file mode 100644
index 0000000..a279191
--- /dev/null
+++ b/NDE/wk2_quiz1.html
@@ -0,0 +1,52 @@
+<!DOCTYPE html>
+<html lang="en">
+<head>
+  <title>NDE Quiz 1</title>
+  <meta property="article:published_time" content="2026-08-25">
+  <meta name="class" content="Network Defense Essentials">
+  <script src="../assignment.js" defer></script>
+</head>
+<body>
+  <header></header>
+  <main>
+    <ol class="quiz-list">
+      <li>
+        <p>Which of the following acts holds “Electronic Transactions and Code Set Standards”?</p>
+        <ul class="options">
+          <li>Federal Information Security Management Act (FISMA)</li>
+          <li>Digital Millennium Copyright Act (DMCA)</li>
+          <li class="correct">Health Insurance Portability and Accountability Act (HIPAA)</li>
+          <li>Gramm-Leach-Bliley Act (GLBA)</li>
+        </ul>
+      </li>
+      <li>
+        <p>Identify the title of the Digital Millennium Copyright Act that implements the World Intellectual Property Organization (WIPO) treaties.</p>
+        <ul class="options">
+          <li>Title V</li>
+          <li>Title II</li>
+          <li>Title III</li>
+          <li class="correct">Title I</li>
+        </ul>
+      </li>
+      <li>
+        <p>Which of the following acts is a United States federal law that requires financial institutions to explain how they share and protect their customers’ private information?</p>
+        <ul class="options">
+          <li>ISO/IEC 27013</li>
+          <li>ISO/IEC 27001</li>
+          <li>Health Insurance Portability and Accountability Act (HIPAA)</li>
+          <li class="correct">Gramm-Leach-Bliley Act (GLBA)</li>
+        </ul>
+      </li>
+      <li>
+        <p>Identify the Internet access policy that enables only safe/necessary services individually, and nonessential services/procedures that cannot be made safe are not allowed.</p>
+        <ul class="options">
+          <li>Permissive policy</li>
+          <li>Promiscuous policy</li>
+          <li class="correct">Prudent policy</li>
+          <li>Paranoid policy</li>
+        </ul>
+      </li>
+    </ol>
+  </main>
+</body>
+</html>
diff --git a/NDE/wk3_quiz1.html b/NDE/wk3_quiz1.html
new file mode 100644
index 0000000..ecd1391
--- /dev/null
+++ b/NDE/wk3_quiz1.html
@@ -0,0 +1,43 @@
+<!DOCTYPE html>
+<html lang="en">
+	<head>
+		<title>Week 3: Quiz 1</title>
+		<meta property="article:published_time" content="2026-09-01">
+		<meta name="class" content="Network Defense Essentials">
+		<script src="../assignment.js" defer></script>
+	</head>
+	<body>
+		<header></header>
+		<main>
+			<ol class="quiz-list">
+				<li>
+					<p>Which of the following layers in the OSI model cannot be protected by using traditional firewalls?</p>
+					<ul class="options">
+						<li>Application layer</li>
+						<li>Data link layer</li>
+						<li class="correct">Physical layer</li>
+						<li>Presentation layer</li>
+					</ul>
+				</li>
+				<li>
+					<p>Which of the following fire suppression systems is used to suppress a fire at the initial stage using a suppressant agent but it cannot be used in case of a fire covering a large area?</p>
+					<ul class="options">
+						<li>Standpipe system</li>
+						<li class="correct">Fire extinguisher</li>
+						<li>Sprinkler system</li>
+						<li>Pre-piped water system</li>
+					</ul>
+				</li>
+				<li>
+					<p>Which of the following physical security systems allows only one person inside and requests an identity; if the identity is invalid, the person is held inside until a security professional arrives?</p>
+					<ul class="options">
+						<li>X-ray inspection systems</li>
+						<li class="correct">Mantrap systems</li>
+						<li>Walkthrough detectors</li>
+						<li>Metal detectors</li>
+					</ul>
+				</li>
+			</ol>
+		</main>
+	</body>
+</html>
diff --git a/app.js b/app.js
new file mode 100644
index 0000000..9349824
--- /dev/null
+++ b/app.js
@@ -0,0 +1,78 @@
+async function loadAtomFeed() {
+  const container = document.getElementById('feed-container');
+
+  try {
+    const response = await fetch('feed.xml');
+    if (!response.ok) throw new Error('Failed to load feed');
+
+    const xmlText = await response.text();
+    const parser = new DOMParser();
+    const xmlDoc = parser.parseFromString(xmlText, 'text/xml');
+
+    const entries = Array.from(xmlDoc.querySelectorAll('entry'));
+    container.innerHTML = '';
+
+    if (entries.length === 0) {
+      container.innerHTML = '<p>No assignments found.</p>';
+      return;
+    }
+
+    // Group entries by class category
+    const groupedByClass = {};
+
+    entries.forEach(entry => {
+      const title = entry.querySelector('title')?.textContent || 'Untitled';
+      const updated = entry.querySelector('updated')?.textContent || '';
+
+      const linkEl = entry.querySelector('link');
+      const link = linkEl ? linkEl.getAttribute('href') : '#';
+
+      // Grab category term or fallback to "General"
+      const categoryEl = entry.querySelector('category');
+      const className = categoryEl ? categoryEl.getAttribute('term') : 'General';
+
+      const itemData = {
+        title,
+        link,
+        updated: updated ? new Date(updated).toLocaleDateString() : ''
+      };
+
+      if (!groupedByClass[className]) {
+        groupedByClass[className] = [];
+      }
+      groupedByClass[className].push(itemData);
+    });
+
+    // Render grouped entries
+    Object.keys(groupedByClass).sort().forEach(className => {
+      const groupSection = document.createElement('section');
+      groupSection.className = 'class-group';
+
+      const classHeader = document.createElement('h2');
+      classHeader.className = 'class-title';
+      classHeader.textContent = className;
+      groupSection.appendChild(classHeader);
+
+      const ul = document.createElement('ul');
+      ul.className = 'feed-list';
+
+      groupedByClass[className].forEach(item => {
+        const li = document.createElement('li');
+        li.className = 'feed-item';
+        li.innerHTML = `
+          <h3><a href="${item.link}">${item.title}</a></h3>
+          ${item.updated ? `<div class="meta">Updated: ${item.updated}</div>` : ''}
+        `;
+        ul.appendChild(li);
+      });
+
+      groupSection.appendChild(ul);
+      container.appendChild(groupSection);
+    });
+
+  } catch (error) {
+    container.innerHTML = `<p>Error loading entries: ${error.message}</p>`;
+  }
+}
+
+loadAtomFeed();
diff --git a/assignment.js b/assignment.js
new file mode 100644
index 0000000..7d8a7a5
--- /dev/null
+++ b/assignment.js
@@ -0,0 +1,82 @@
+function addMetadata() {
+    // Favicon
+    const favicon = document.createElement("link");
+    favicon.rel = "icon";
+    favicon.href = "../Logo.svg";
+    favicon.type = "image/svg+xml";
+    document.head.appendChild(favicon);
+
+    // UTF-8 charset
+    const charset = document.createElement("meta");
+    charset.setAttribute("charset", "UTF-8");
+    document.head.appendChild(charset);
+
+    // Viewport for mobile
+    const viewport = document.createElement("meta");
+    viewport.setAttribute("name", "viewport");
+    viewport.setAttribute("content", "width=device-width, initial-scale=1.0");
+    document.head.appendChild(viewport);
+
+    // Primary stylesheet
+    const css = document.createElement("link");
+    css.rel = "stylesheet";
+    css.href = "../style.css";
+    document.head.appendChild(css);
+}
+
+function addHeader() {
+    const header = document.querySelector("header");
+    if (!header) return;
+
+    // Back Link
+    const backLink = document.createElement("a");
+    backLink.href = "../index.html";
+    backLink.classList.add("header-logo-link");
+    backLink.textContent = "<- Back to Index";
+    header.appendChild(backLink);
+
+    // Right-side info container
+    const info = document.createElement("div");
+    info.classList.add("header-info");
+
+    // Title from document.title
+    const h1 = document.createElement("h1");
+    h1.textContent = document.title;
+    info.appendChild(h1);
+
+    // Read date from <meta property="article:published_time">
+    const metaDate = document.querySelector('meta[property="article:published_time"]');
+    if (metaDate) {
+        const dateString = metaDate.getAttribute("content");
+        const displayDate = (new Date(dateString)).toLocaleDateString("en-US", {
+            month: "short",
+            day: "numeric",
+            year: "numeric",
+            timeZone: "UTC"
+        });
+
+        const time = document.createElement("time");
+        time.setAttribute("datetime", dateString);
+        time.textContent = `Updated ${displayDate}`;
+        info.appendChild(time);
+    }
+
+    // Read class tag from <meta name="class">
+    const metaClass = document.querySelector('meta[name="class"]');
+    if (metaClass) {
+        const classTag = document.createElement("span");
+        classTag.classList.add("class-tag");
+        classTag.textContent = `Class: ${metaClass.getAttribute("content")}`;
+        info.appendChild(classTag);
+    }
+
+    header.appendChild(info);
+
+    const hr = document.createElement("hr");
+    header.appendChild(hr);
+}
+
+document.addEventListener("DOMContentLoaded", () => {
+    addMetadata();
+    addHeader();
+});
diff --git a/feed.xml b/feed.xml
new file mode 100644
index 0000000..7bbf84c
--- /dev/null
+++ b/feed.xml
@@ -0,0 +1,35 @@
+<?xml version="1.0" encoding="utf-8"?>
+<feed xmlns="http://www.w3.org/2005/Atom">
+  <title>JTA</title>
+  <updated>2026-08-21T10:00:00Z</updated>
+
+  <entry>
+    <title>Week 3: Quiz 1</title>
+    <link href="NDE/wk3_lab1.html" />
+    <category term="Network Defense Essentials" />
+  </entry>
+
+  <entry>
+    <title>Week 2: Lab Assignment 1</title>
+    <link href="NDE/wk2_lab1.html" />
+    <category term="Network Defense Essentials" />
+  </entry>
+
+  <entry>
+    <title>Week 2: Quiz 1</title>
+    <link href="NDE/wk2_quiz1.html" />
+    <category term="Network Defense Essentials" />
+  </entry>
+
+  <entry>
+    <title>Week 1: Lab Assignment 1</title>
+    <link href="NDE/wk1_lab1.html" />
+    <category term="Network Defense Essentials" />
+  </entry>
+
+  <entry>
+    <title>Week 1: Quiz 1</title>
+    <link href="NDE/wk1_quiz1.html" />
+    <category term="Network Defense Essentials" />
+  </entry>
+</feed>
diff --git a/index.html b/index.html
new file mode 100644
index 0000000..cbe1802
--- /dev/null
+++ b/index.html
@@ -0,0 +1,16 @@
+<!DOCTYPE html>
+<html lang="en">
+	<head>
+		<meta charset="UTF-8">
+		<meta name="viewport" content="width=device-width, initial-scale=1.0">
+		<title>Study Materials Index</title>
+		<link rel="stylesheet" href="style.css">
+	</head>
+	<body>
+		<div id="feed-container">
+			<p class="loading">Loading materials...</p>
+		</div>
+
+		<script src="app.js"></script>
+	</body>
+</html>
diff --git a/style.css b/style.css
new file mode 100644
index 0000000..24b5261
--- /dev/null
+++ b/style.css
@@ -0,0 +1,143 @@
+body {
+  font-family: system-ui, -apple-system, sans-serif;
+  max-width: 800px;
+  margin: 2rem auto;
+  padding: 0 1rem;
+  background-color: #f9f9f9;
+  color: #333;
+}
+
+h1 {
+  border-bottom: 2px solid #ddd;
+  padding-bottom: 0.5rem;
+}
+
+.class-group {
+  margin-bottom: 2rem;
+}
+
+.class-title {
+  color: #2c3e50;
+  border-bottom: 1px solid #ccc;
+  padding-bottom: 0.25rem;
+}
+
+.feed-list {
+  list-style: none;
+  padding: 0;
+}
+
+.feed-item {
+  background: #fff;
+  margin-bottom: 0.75rem;
+  padding: 1rem 1.5rem;
+  border-radius: 8px;
+  box-shadow: 0 2px 4px rgba(0,0,0,0.05);
+}
+
+.feed-item h3 {
+  margin: 0 0 0.5rem 0;
+  font-size: 1.1rem;
+}
+
+.feed-item a {
+  color: #0066cc;
+  text-decoration: none;
+}
+
+.feed-item a:hover {
+  text-decoration: underline;
+}
+
+.meta {
+  font-size: 0.85rem;
+  color: #666;
+}
+
+.loading {
+  color: #666;
+  font-style: italic;
+}
+
+header {
+  display: flex;
+  flex-direction: column;
+  gap: 1rem;
+  padding: 1.5rem 0 1rem 0;
+  margin-bottom: 2rem;
+
+  .header-logo-link {
+    display: inline-block;
+    color: #0066cc;
+    text-decoration: none;
+    font-weight: 500;
+    font-size: 0.95rem;
+    transition: color 0.2s ease;
+
+    &:hover {
+      color: #004499;
+      text-decoration: underline;
+    }
+  }
+
+  .header-info {
+    display: flex;
+    flex-direction: column;
+    gap: 0.35rem;
+
+    h1 {
+      margin: 0;
+      font-size: 2rem;
+      color: #1a1a1a;
+      letter-spacing: -0.02em;
+    }
+
+    time, .class-tag {
+      font-size: 0.875rem;
+      color: #666;
+    }
+
+    .class-tag {
+      font-weight: 600;
+      color: #4a5568;
+    }
+  }
+
+  hr {
+    border: none;
+    border-top: 1px solid #e2e8f0;
+    margin-top: 0.5rem;
+    margin-bottom: 0;
+  }
+}
+
+.quiz-list {
+  padding-left: 1.2rem;
+
+  & > li {
+    margin-bottom: 2rem;
+  }
+}
+
+.options {
+  list-style: none;
+  padding: 0;
+  margin-top: 0.5rem;
+
+  li {
+    padding: 0.5rem 0.75rem;
+    margin-bottom: 0.35rem;
+    border: 1px solid #e2e8f0;
+    border-radius: 6px;
+    background-color: #fff;
+    color: #4a5568;
+
+    &.correct {
+      border-color: #86efac;
+      background-color: #f0fdf4;
+      color: #166534;
+      font-weight: 600;
+      position: relative;
+    }
+  }
+}