Acquire & Examine a Forensic Image

A USB drive was seized from a suspect workstation and imaged to /evidence/usb_case.img. Before you touch the contents you must preserve integrity (record a cryptographic hash), then examine the image WITHOUT altering it to pull the case reference the holder hid in their notes. Sound handling means working from the image file read-only — never mounting it read-write and never editing it.

Produce two files: /root/case/image.sha256 (the image's SHA-256; sha256sum's own <digest> <path> line is fine — grading recomputes the image's hash, so it must match, and an image altered after you hashed it no longer does) and /root/case/incident_ref.txt (the case token from the notes: the whole notes file, the token's line, or the bare token value are all accepted — a copy of the image, or strings of the whole image, is not).