Windows Forensics Cookbook

Introduction

Being able to accurately view and analyze results is an important part of any investigation. Even before the final results stage, however, it can be useful to be able to look at and manipulate different factors within a case, so as to work out where it might be necessary to drill down further, and to uncover correlations that otherwise may be overlooked.

While the primary goal of digital forensics tools is not to look pretty but to uncover, analyze, and report back on data, the visualization process is nonetheless an important part of any software.

A well put together data visualization tool can demonstrate links between contacts, build a timeline and identify potential points of interest along it, bring to light geographical ...