Part II of the analysis phase involves telling the story of the evidence; connecting the dots between all the relevant data found. If phase I of the investigation did not turn up evidence, then this phase will be an expansion of the methods used in the last session. We will cast a wider net and go wider and deeper into our investigation.
In this masters class webcast, you’ll learn:
- How to figure out where the files came from, if they were changed, and when things happened to build a timeline of events.
- When to expand the investigation to find more evidence with diverse processing of artifacts and searching for deleted content.
View On-Demand Webcast
