Version 3.78 -Moved Alternative Imaging tools section to "Advanced Forensics" -added detail on the output of some TSK tools (by request). -reorganized the Sleuthkit NTFS examination sections to account for changes in TSK 3 (orphan files). Exercise on NTFS deleted files was removed, since TSK 3 makes it moot. -added material to NTFS section on more detailed file analysis. -changed unallocated examination exercise to account for change in tool names from d* to blk* in TSK 3. -cleaned up the section on getting help (last page). Version 3.65 -Switched to 2.6 kernel install in intro (Slackware 12.1). -Added brief section on device detection (by request). -updated details for recent versions of Linux tools. -updated Sleuthkit and libewf section to account for changes in install for TSK > 2.50 (autotools build design). -moved libewf before TSK to account for lib install. -added section on alternative imaging tools (dc3dd,ddrescue) -added dls exercises by request (TSK). -added brief exercise on sigfind (TSK). Version 3.20 -added compression on the fly exercise (for dd). -added dd over the wire (network acquisition). -added more detailed Sleuthkit section (commands) -added TSK NTFS exercises (ADS, deleted files,sorter) -added deleted file allocation determination and recovery exercise (TSK/EXT2) -removed support for Autopsy (I just don't use it anymore-I'll add it back if enough people request it). -added libewf section. -removed reference to NASA loopback (unsupported) -added SMART filtering section using NTFS (classroom exercise) -added SMART search section using EXT (classroom exercise). -added section on configuring Slackware if a 2.6 kernel version is used (12.x). Version 2.55 -added a changelog ;-) -Document is now Slackware centric -updated to Sleuthkit 2.0x (full disk images and split support) -updated to Autopsy 2.0x (for use with new TSK) -formatting changes for readability