: Autopsy, FTK Imager, Volatility, or Wireshark. 2. Clinical or Regulatory Documentation (EMA)

(e.g., "Find the attacker's IP," "Extract the hidden flag," or "Summarize the clinical findings").

(e.g., a CTF competition like CyberDefenders, a professional forensic case, or a regulatory portal).