1 2 3 4 5 6
1. xmount --in ewf Windows_Evidence_001.E01 /home/jason/Documents 2. 8 3. dd if=/dev/fmem of=/home/james/Documents/test_ram.dd bs=1MB 4. NTFS 5. 346849 6. disk_analysis.py
