The computer: combine the evidence
Fictional case; no machine was inspected.

Host: 16 GiB RAM, x86-64 CPU, 120 GiB free storage.
Guest: Ubuntu VM, normal virtual disk, 4 GiB RAM, no shared folders.
Saved program file: viewer.
Saved data file: guest Documents/map.txt.
Running processes: PID 71 viewer; PID 72 viewer.
Exchange: guest viewer requests a map; remote service sends map data.
M0 snapshot: guest map.txt contains route A.
Later: guest map.txt contains route B; host Downloads/receipt.txt created.

Write five short explanations:
1. How RAM and storage have different jobs.
2. Which items are a program file, data file and running processes.
3. Which participant requests and which responds.
4. What restoring M0 would do to map.txt.
5. Why M0 would not rewind the host receipt or remote service.
Use the lesson's rubric to review your note.