Masters of Digital Forensics Course # 3: Capturing the low hanging fruit—analysis phase, Part I

The initial part of the investigation or analysis process involves a first pass to look for key evidence or "low hanging fruit". This step is more involved and thorough than triage. After the initial analysis, forensic examiners might bring in others to review and further identify items of relevance to help guide a deeper analysis (coming in Part II).

Watch this on-demand video to learn how to:

Execute minimal processing for the file types you think the evidence might be in.
Run keyword searches, filtering, and look in key locations for evidence.
How to prepare the potential evidence for review.

Spotlight

Spotlight

Ongoing Initiatives

Masters of Digital Forensics Course # 3: Capturing the low hanging fruit—analysis phase, Part I

Related Resources

Masters of Digital Forensics Course # 1: Imaging—The Easy Part! Or is it? Mastering Collection & Acquisition

Masters of Digital Forensics Course # 2: Work smarter, not harder: optimize your system for faster forensic processing

Masters of Digital Forensics Course # 4: Casting a wider net—analysis phase, Part II