If an offender performs criminal acts in a virtual environment of a virtual machine instead of a physical machine, performing forensics on the physical machine does not provide an answer of what happened. How can this issue be addressed? If the offender also has a smartphone that frequently connects to an e-mail cloud, what would the standard procedures be to conduct forensics? How would you analyze the offenders computer that uses an SSD drive?