I hope I never have to use this and I hope nobody ever has to use it on a computer of mine, but this document from Microsoft looks very interesting.
Fundamental Computer Investigation Guide For Windows
The document includes information for building an investigative toolkit as well as good practices. I was hoping that they would have some good partition duplicators available. Before digging into a drive I would like to make a duplicate of it in order to go back to a fresh start if anything should go wrong. Something like GParted would be good for that.
0 Response to “How to Investigate a Windows PC”