24. Examine Suspect Capabilities

• Which programs were installed?

• Popular programs to hide or alter evidence may include

  • Eraser

  • Timestomp

  • FileStomp

  • PGP

  • TrueCrypt