It has come to my attention that the M57 Jean practice case is still being used as a teaching aid so consequently I will be removing my plan of attack post (#2) and heavily redacting my conclusions post (#3).
I will try to leave the first post up so interested users can still mount the Encase files on SANS SIFT but I can't leave my strategy/answers.
I apologise for this oversight and any inconvenience this may have caused to either yourself or Digital Corpora students/users.
Banana-fully Yours,
Cheeky4n6Monkey
