## Lab 3: Data Acquisition and Duplication
<!-- th -->
!th[c](lab3_lab.png)

1. `xmount --in ewf Windows_Evidence_001.E01 /home/jason/Documents`
2. `8`
3. `dd if=/dev/fmem of=/home/james/Documents/test_ram.dd bs=1MB`
4. `NTFS`
5. `346849`
6. `disk_analysis.py`