Continuing from yesterday, the investigator will initially focus on key files found on the Windows operating system that contains evidence. These files could be especially important to an investigation, providing key evidentiary links to pictures, edited or printed office documents, or files that were saved to a removable device.

With the increasing use of the web and the shift toward cloud computing using web-based applications, it is essential that browser forensic analysis is key to the investigator's skills. The investigator will explore comprehensive web browser evidence that is created during the use of Internet Explorer and Firefox. The analyst will learn how to examine cookies, history, and Internet cache files of the suspect’s system. We will show you where you can examine these files and the common mistakes amateur investigators make when looking at browser artifacts.

Throughout the day, the investigator will utilize their skills in real hands-on cases, exploring evidence create by Firefox and Internet Explorer and Windows OS artifacts discussed throughout the day.