In the last chapter, we started out looking at the modules that the EnCase Evidence Processor provided. We began the process of looking at the results and documenting the basic elements of the case. We continue the initial documentation of the system as we go through the modules that we’ve processed. Even if you don’t find that everything you document is directly relevant to reconstructing the events in question, it is a good practice to document the basic state of the system when it was imaged. Sometimes this provides good leads to work on later down the road. It is a sign that the investigator has done a thorough ...