 |
Examination
Examination of electronic evidence may require methodical
and documented analysis of a
computer's system areas, including File Allocation Tables (FATs),
directory structures, partition areas, temporary files, cache files, swap files,
temporary internet history and cache files and mail files and more.
In-depth examination may require the examination and evaluation of installed
programs and executable files as well as examination of compressed (zipped) file
and unused areas of a computer's disk space. Some of these areas are hidden
and/or somewhat difficult to interpret without using specialized tools.
Examination may involve documentation and
recovery of erased files as well as involve searches of the disk for certain key
phrases. Specific issues dictate the extent of examination.
|
