 |
EVIDENCE
RECOVERY: ADVANTAGES OF DIGITAL EVIDENCE
|
 |
In addition to the advantages of recovering deleted files, digital
evidence contains a wealth of critical data and "embedded" information
for both intact files as well as deleted files. For example, forensic
software can view the contents of a Excel file to reveal, (depending on
how it was configured by the user), information such as: the creation
date and original author; dates the file was last accessed, modified
and printed; when the file was last saved and by whom; the number of
times the file was edited, for how long and by whom; the number of
revisions; client name, ID and reference number; hidden key words and
comments that identify who edited or collaborated on the file; and the
original file location.
For
example, WordPerfect allows the user to open a saved file and "undo"
the last 20 or so modifications, charting the latest changes that have
been made to the document. Word has a tracking device that can be
secured with a password that can invisibly track ALL changes made on a
document allowing a subsequent user with a password to review every
keystroke and peruse every comment made to the document.
Searches
also could reveal embedded information in email headers including
routing details and a list of associated file attachments. Palms and
other digital assistants leave a log of when they were last synched
with the desktop, and what information was downloaded. WinFax keeps a
log file of all electronic faxes sent, sometimes for years after the
original document was lost or destroyed.
