TuckerHST wrote:
If there is evidence of software like CCleaner being installed, you might also want to assert that the computer was likely wiped (otherwise, why no deleted contraband files, or other relevant evidence in unallocated space?).
Or, more simply, correctly maintained:
http://www.forensicfocus.com/Forums/viewtopic/t=5410/
Please also remember - generally speaking - that you have to place the suspect before the keyboard and screen, see:
http://www.forensicfocus.com/Forums/viewtopic/t=9275
http://www.forensicfocus.com/Forums/viewtopic/p=6559899/#6559899
jaclaz
↧