%PDF-1.5 % 4 0 obj << /S /GoTo /D (section.1) >> endobj 7 0 obj (Introduction) endobj 8 0 obj << /S /GoTo /D (section.2) >> endobj 11 0 obj (Part 1: Evidence of a Crime) endobj 12 0 obj << /S /GoTo /D (subsection.2.1) >> endobj 15 0 obj (Hardware Properties of the Memory Device) endobj 16 0 obj << /S /GoTo /D (subsection.2.2) >> endobj 19 0 obj (FAT Investigation) endobj 20 0 obj << /S /GoTo /D (subsection.2.3) >> endobj 23 0 obj (Investigation of Directories) endobj 24 0 obj << /S /GoTo /D (subsection.2.4) >> endobj 27 0 obj (Attack on a Zip-archive) endobj 28 0 obj << /S /GoTo /D (section.3) >> endobj 31 0 obj (Part 2: USB Flash Analysis) endobj 32 0 obj << /S /GoTo /D (subsection.3.1) >> endobj 35 0 obj (Preparation) endobj 36 0 obj << /S /GoTo /D (subsection.3.2) >> endobj 39 0 obj (Kahli Virtual machine) endobj 40 0 obj << /S /GoTo /D (appendix.A) >> endobj 43 0 obj (Beginning of Image File) endobj 44 0 obj << /S /GoTo /D [45 0 R /Fit] >> endobj 48 0 obj << /Length 1456 /Filter /FlateDecode >> stream xXKs6WHxqN'S7J$: )9'3mbvaFVw3|B ̯Ph(MK19[~IA$nQ,L2TnoO
,y.wQ0OHq+7;@\*\XRl\?Iz;}qeuM4H H
JN7**FF=4TZ*L4@r:^:wSIYzNy qҳ~皢Bt$RIN UT*ʅ0eoWn1^fzN1oDan0G57s`(X96=x]-
\Yʤ 7*>BauA0~=R*_5vrSeѿuω;Y"'gX10m >["M\R:8Mur}]=qTMEJLq"ښBQ@gXB1
C
5.2mgJHМ1*xq_
wT u8V߯D9a|$²%@
fR-!\$LSp5~%cX:FQ#ohqD#arNZPHn