In the first section of this chapter, we explored the types of evidence you can look for on a computer. What happens when you can’t find any evidence but you know it’s there? Chances are it’s either hidden, or somewhere in the trace evidence. (We cover trace evidence in the next section.)
Data component that describes other data. In other words, it’s data about data.
There are various types of hidden evidence, starting with document metadata. Virtually all applications produce some type of evidence that ordinary users don’t know about. For example, as a Microsoft Word document is written and changed, changes are normally tracked. To view this information, simply click the file and then choose Properties (see ...