23. Get the Feel of the Suspect

• Exploring the Documents and Settings for users

• Matching the user names to the suspect

• Identify if the user is doing bad stuff

• To ID the activity on this computer, check:

  • Desktop

  • Recent files

  • Temporary Internet files

  • Send To Folder

• How is the user using this computer?

• Manually search identified areas