
49
Chapter 3
Concealment Techniques
You Cannot Find What You Cannot Investigate
Of the many issues facing the cyber forensic investigator one initial issue is determining where
evidence may be found and where to actually begin to look for the electronic evidence. Even more
pressing an issue however, is determining where evidence may be hidden.
Many an investigator will begin by examining the more obvious places where electronic evidence
is to be found, such as slack space, swap fi les, drive slack, etc. However, as technology evolves, so do
the opportunities for new and innovative ways and methods for concealing potential evidence, by
those ind