Derek worked through CTF images using Practical Linux Forensics as a reference. X-Ways Forensics and Windows Subsystem for Linux are also used.