Memory, network, browser artifact, steganography, and timeline analysis labs.
Receive a USB drive image for a live case, identify it by its contents, verify it against the field examiner's hashes, catch a tampered working copy, and take in new evidence with an unbroken chain of custody.