This chapter described in more detail the process of locating and selecting evidence in terms of a general process. It also further explained the nature of digital evidence and provided examples of its value in supporting a legal case. Various advanced analysis and recovery tools were demonstrated that show you how technology can speed up and make more efficient the evidence location and selection processes. Some of these tools are not new but have been enhanced, while others are innovative, and seek out evidence normally unavailable to the practitioner.
The majority of laptop, desktop, and network-based computers use Windows operating systems, which have been covered in varying details in this and previous chapters. Chapter 7, Windows and Other Operating Systems as Sources of Evidence, will outline Windows Registry and system files and logs, and some additional benefits of VSS recovery will be introduced as a resource for digital evidence recovery and analysis. It will describe in...