The initial part of the investigation or analysis process involves a first pass to look for key evidence or "low hanging fruit". This step is more involved and thorough than triage. After the initial analysis, forensic examiners might bring in others to review and further identify items of relevance to help guide a deeper analysis (coming in Part II).
Watch this on-demand video to learn how to:
- Execute minimal processing for the file types you think the evidence might be in.
- Run keyword searches, filtering, and look in key locations for evidence.
- How to prepare the potential evidence for review.
View On-Demand Webcast