O'Reilly logo

Computer Forensics JumpStart, Second Edition by Diane Barrett, Neil Broom, Ed Tittel, K Rudolph, Michael G. Solomon

Stay ahead with the world's most comprehensive technology and business learning platform.

With Safari, you learn the way you learn best. Get unlimited access to videos, live online training, learning paths, books, tutorials, and more.

Start Free Trial

No credit card required

Hidden Evidence

In the first section of this chapter, we explored the types of evidence you can look for on a computer. What happens when you can’t find any evidence but you know it’s there? Chances are it’s either hidden, or somewhere in the trace evidence. (We cover trace evidence in the next section.)

Metadata

metadata

Data component that describes other data. In other words, it’s data about data.

There are various types of hidden evidence, starting with document metadata. Virtually all applications produce some type of evidence that ordinary users don’t know about. For example, as a Microsoft Word document is written and changed, changes are normally tracked. To view this information, simply click the file and then choose Properties (see ...

With Safari, you learn the way you learn best. Get unlimited access to videos, live online training, learning paths, books, interactive tutorials, and more.

Start Free Trial

No credit card required