So in section 8 if I got it right there can be web cash memory and recently added devices. So my question is : 1. Isn’t web cash memory temporary data and shouldn’t it be deleted in original
device? So how autopsy find it?
2. How can autopsy find recently added devices(is there place on PC that
writes when we plug in new device like USB,…)?
Thanks in advance