
28
DIGITAL FORENSICS EXPLAINED
Review of Allocated Graphics
Photoshop files or other unique graphic files?
Scanned images?
EXIF data?
Allocated
Review of Movies Allocated
Review of Lost, Orphaned, Unallocated Graphics or
Recovered from within files (i.e., umbs, Cache,
Doc, Zips)
Unallocated
Review of Documents and Writings
(i.e., file extensions)
TXT WPS
PDF WKS
DOC XLS
RTF CSV
Allocated Unallocated
Programs, Logs, System Files, Communications,
Recycle Bin
Completed by
Date
Forensic Exam Log CCU #
Page of
Date Name Item # Notes
Figure 2.3 (Continued) Computer forensics examination form.