PART
III
Looking for Artifacts
This section is all about using EnCase to help you get to the artifacts in your case that most matter to you. In some instances, this is done using the Evidence Processor, which was introduced in Chapter 6 and is continued in Chapter 7.
We look at the Case Analyzer in Chapter 8, where artifacts from multiple different areas can be put together to give you a picture of what is happening on the system. We also dig into creating your own custom Case Analyzer reports for artifacts that are not associated already for you in the EnCase interface.
Finally, Chapter 9 is all about searching—which is a big part of a number ...
Get Computer Forensics and Digital Investigation with EnCase Forensic v7 now with the O’Reilly learning platform.
O’Reilly members experience books, live events, courses curated by job role, and more from O’Reilly and nearly 200 top publishers.
