Computer Forensic Analyst (Model Examinations): Difference between revisions
m Text replacement - "'''([a-zA-Z]+ [a-zA-Z]+ [a-zA-Z]+ [a-zA-Z]+)'''<br>" to "; $1" |
No edit summary |
||
| Line 159: | Line 159: | ||
** dates of created, modified, and accessed / comment on accuracy of times and dates / other ways of determining date they were downloaded, opened or deleted | ** dates of created, modified, and accessed / comment on accuracy of times and dates / other ways of determining date they were downloaded, opened or deleted | ||
; Signs of User's Identity | |||
* examined files for signs of who uses the account: | * examined files for signs of who uses the account: | ||
** checked OS registry / registered owner’s name | ** checked OS registry / registered owner’s name | ||
| Line 168: | Line 168: | ||
** connection with web log-in accounts with a certain name | ** connection with web log-in accounts with a certain name | ||
; Signs of User's Familiarity with Computers | |||
* consider whether settings of P2P software were modified | * consider whether settings of P2P software were modified | ||
* other software installed on machine, software that is generally directed at advanced user | * other software installed on machine, software that is generally directed at advanced user | ||