You are conducting an investigation and have encountered a computer that is running in the field. The operating system is Windows XP. A software program is currently running and is visible on the screen. You should:
How does EnCase verify that the case information (Case Number, Evidence Number, Investigator Name, etc) in an evidence file has not been damaged or changed, after the evidence file has been written?
A file extension and signature can be manually added by:
Temp files created by EnCase are deleted when EnCase is properly closed.
The case file should be archived with the evidence files at the termination of a case.
The case number in an evidence file can be changed without causing the verification feature to report an error, if:
