Output details

Forensic Data Recovery From The Windows Search Database

<29>This paper takes a principled approach to contrasting different ways of identifying and recovering data which is not otherwise available to a forensic computer analysis, for example portable storage which has been only temporarily connected to a machine under investigation or where data are encrypted. This approach differentiates it from many forensic results that are primarily concerned with software artefacts. The broad international impact of this work is evident from the resulting requests for information, help, and software tools from law enforcement officers, commercial forensic analysts, and also forensic educators (e.g. Canadian Police College, Research Council of Italy).