Quantcast
Channel: Forensic Focus Forums - Recent Topics
Viewing all articles
Browse latest Browse all 20112

General Discussion: Interpreting ShellBags

$
0
0
Cults14 wrote: My deduction is that there were two different drives, with some similar folder structures, connected at the same time any facts to back up your deduction? Any idea what these drive letters were pointing at at the time (setupapi log, mounted USB, firewire devices, network drives, etc?) Why can't they be the same drive with a different volume letters assigned to it? What about subst 2 drive letters for the same volume?

Viewing all articles
Browse latest Browse all 20112