I found it hardest to figure out the "correct" choice for the first shift. I reran this three times to figure out how to preserve the chain of evidence.