2. An employee at the ACME company, Malice, has carried out an insider attack, abusing his access to company computers to take revenge for perceived poor treatment. In particular, Malice placed a virus on company computers, which resulted in proprietary data being deleted within the operating system. Malice disappeared just after the attack, leaving his workstation computer running.

(A) Explain what the digital forensics analyst needs to do, and not do, to preserve the evidence on Malices workstation. Be sure to consider all the parts of the computer we have discussed in recent modules.

(B) Explain what methods could be used to attempt to recover the data that was deleted in the attack.