eBook - Forensics and the World of eDiscovery Vol.1 May, 2014 | Page 7

An investigator could determine that a
particular file was modified by a user
but not while they were sitting at a
computer by looking at the registry
historical information, computer log files
and individual documents.

You Still Need Forensics

A forensics investigator can see how an
individual document fits in the context of
the rest of the computer.