Create lab2-evidence-preservation.md

Author: ngvuthdanhh

labs/lab2-evidence-preservation.md

@@ -0,0 +1,15 @@
+# Lab 2 – Evidence Preservation
+
+## Objective
+Practice proper acquisition and preservation of digital evidence.
+
+## Tasks
+1. Create a forensic disk image (E01 or RAW).
+2. Capture volatile memory.
+3. Calculate and verify hashes.
+4. Maintain a chain-of-custody record.
+
+## Expected Output
+- Hash log  
+- Acquisition report  
+- Chain-of-custody template