Computer Forensics: Examining File Slack with EnCase
Update: 2008-08-31
Description
Demonstrating File slack with with EnCase. File slack can, sometimes, contain information relevant to a case. Even if it does not its important for computer forensics examiners to understand the difference between active files, deleted files, and slack hits.
Comments
In Channel