by admin-jon | Aug 13, 2008 | Blog, Metadata, Preservation, Tips & Tricks
The terms, ‘file timestamps’ and ‘file metadata’ are often used interchangeably, however, they can have two completely different meanings. I trust the following will help clarify the differences. 1) There are two separate ‘timestamps’ for office documents and several...
by admin-jon | Aug 12, 2008 | Blog, Data Recovery, File Header, Tips & Tricks
Many file types can be identified by using what’s known as afile header. A file header is a ‘signature’ placed at the beginning of a file, so the operating system and other software know what to do with the following contents. Many electronic discovery applications...
by admin-jon | Aug 5, 2008 | Blog, Data Recovery, Tips & Tricks
To recover deleted files, user activity logs, Internet history, and other potentially relevant custodian information, a ‘physical’ copy or forensic image of the hard drive or other media is required. Creating a physical copy or forensic image preserves the...
by admin-jon | Jul 31, 2008 | Tips & Tricks
In my last post, I mentioned there are a couple of ways to identify if files have been stored on an external device. Here they are: 1) Examine the file access history – To be thorough, you need to look at two different user activity areas. 1) User activity logs...
