a) Making a forensic image is an important step in Data Acquisition. Compare the different formats of the image files in terms of speed, error handling, compatibility, compression, segmentation and file size limitations.

b) You get a call from a high school student named Marco who claims he just received an e-mail from another student threatening to commit suicide. Marco isnt sure where the student sent the e-mail from. Write a brief report explaining how you should proceed, including what you should do first in this situation.

c) When the computer memory has been acquired while the seized computer was still running, the memory dump (Random Access Memory-RAM) can be analysed in the digital forensic lab. List the typical artefacts that could be extracted from the memory dumps.