Computer Forensics and Digital Investigation with EnCase Forensic v7

CHAPTER

7

Further Inspection

In the last chapter, we started out looking at the modules that the EnCase Evidence Processor provided. We began the process of looking at the results and documenting the basic elements of the case. We continue the initial documentation of the system as we go through the modules that we’ve processed. Even if you don’t find that everything you document is directly relevant to reconstructing the events in question, it is a good practice to document the basic state of the system when it was imaged. Sometimes this provides good leads to work on later down the road. It is a sign that the investigator has done a thorough ...