by admin-jon | Jul 31, 2008 | Tips & Tricks
In my last post, I mentioned there are a couple of ways to identify if files have been stored on an external device. Here they are: 1) Examine the file access history – To be thorough, you need to look at two different user activity areas. 1) User activity logs...
by admin-jon | Jul 31, 2008 | Blog, Uncategorized
A client asked me if it was possible to determine if a custodian did copy files from their server to an external USB flash drive. The USB drive isn’t available, so they wanted to know if Microsoft Windows tracks where files are copied. Now, you would think that...
by admin-jon | Jul 31, 2008 | Welcome Message
I started this blog to help decrease the gap between computer forensics and litigation support. This gap has caused a considerable amount of confusion and frustration for many good-natured, hard- working legal and IT professionals. Many of you probably realize that...
