| <<< Digital Crime Scene Process | Index | Event Reconstruction Phase >>> |
After original media is preserved, we need to search for evidence
Most of evidence searches are done in a file system and inside files
| <<< Digital Crime Scene Process | Index | Event Reconstruction Phase >>> |