preview

What Is Deleted Autopsy

Satisfactory Essays

The deleted file of interest to this investigation from the image drive by exploring the image in Autopsy is the Outlook files. I can use the deleted Outlook files to analyze the communications between Mr. Barzini and Mr. Lawless or with other people. For example, I can view the Outlook.pst which is an e-mail file in Joey’s outlook folder located at C:/Documents and Settings/Joey/Local Settings/Application Data/Microsoft/Outlook/Outlook.pst (screenshots below). With proper tools, I can retrieve the file and view all Joey’s e-mails which is a big lead in the

Get Access