Computer Forensic Analyst (Model Examinations): Difference between revisions
m 1 revision imported |
No edit summary |
||
| (One intermediate revision by the same user not shown) | |||
| Line 149: | Line 149: | ||
|- | |- | ||
| | | | ||
; Contents of the Computer | |||
* found any files that were relevant to the case | * found any files that were relevant to the case | ||
* types of files (pictures, videos, documents) | * types of files (pictures, videos, documents) | ||
| Line 159: | Line 159: | ||
** dates of created, modified, and accessed / comment on accuracy of times and dates / other ways of determining date they were downloaded, opened or deleted | ** dates of created, modified, and accessed / comment on accuracy of times and dates / other ways of determining date they were downloaded, opened or deleted | ||
; Signs of User's Identity | |||
* examined files for signs of who uses the account: | * examined files for signs of who uses the account: | ||
** checked OS registry / registered owner’s name | ** checked OS registry / registered owner’s name | ||
| Line 168: | Line 168: | ||
** connection with web log-in accounts with a certain name | ** connection with web log-in accounts with a certain name | ||
; Signs of User's Familiarity with Computers | |||
* consider whether settings of P2P software were modified | * consider whether settings of P2P software were modified | ||
* other software installed on machine, software that is generally directed at advanced user | * other software installed on machine, software that is generally directed at advanced user | ||
* signs of customized operating system, desktop, etc. / how much different did set up look from the default installation out of the box | * signs of customized operating system, desktop, etc. / how much different did set up look from the default installation out of the box | ||
; Other Potentially Relevant Information | |||
* details on the software packages installed on the machine | * details on the software packages installed on the machine | ||
* details regarding OS installation (time and date, by whom) | * details regarding OS installation (time and date, by whom) | ||