3. computer evidence

• What type evidence might be found on a computer?

  • generic data files: word processing documents, spreadsheets, presentations, drawings, graphical images, audio and video files, e-mail, IM and chat logs, and just about any other type of file...

  • files unknown to the user: web browsing cache, web history, sometimes cached passwords, cookies, system swap files, registry data...

  • deleted files continue to reside on the computer -- just about everything that was ever written to the hard drive by any application for any reason.

  • data file contents: financial records, medical records, photographs, drawings, personal correspondence, business records and corporate information, records of activities, and massive amounts of other personal and business information.