| <<< View File Signature Analysis Results | Index | Next Steps and The Search Warrant >>> |
Unallocated space may contain a lot of evidence.
The task is to locate such data and document the findings.
Typical searches:
ASCII and UNICODE text strings (e.g. user names, logon names, passwords, other keywords)
A particular file signature.
See EnCase Lessons 9 and 21 for details.
| <<< View File Signature Analysis Results | Index | Next Steps and The Search Warrant >>> |