So in section 8 if I got it right there can be web cash memory and recently added devices. So my question is : 1. Isn’t web cash memory temporary data and shouldn’t it be deleted in original
device? So how autopsy find it?
2. How can autopsy find recently added devices(is there place on PC that
writes when we plug in new device like USB,…)?
Thanks in advance
The web cache results aren’t from system memory, they’re from data that the web browser saves. When you want to know where a result comes from, select it and look in the File Metadata tab. This will show what file the result is associated with. Doing this with one of the USB Device results will show that they come from the Windows registry.
Dear all…
can i continue my course , is that what you mean. i will appreciated if you assist me, because due the current situation we was busy and many issue appear in our daily day. if it possible to assist i will thanks full. otherwise i will thanks you again for your cooperation.
regards,
badreya
