Question

You just started working for a digital forensics firm. and have been

assigned your first case working closely with a senior technician.

The chain of custody record was updated when the item was

received into inventory and you updated the chain of custody tag

when you opened the secure storage. You took a backup of the

disk using DD and ran the image through Autopsy. Returned it to

the secure storage and updated the chain of custody tag. At this

point you got stuck in your investigation as you have been unable

to find anything that was tagged in autopsy as being potentially

relevant. You spent hours reviewing the data with no luck. You feel

like all you need is a hint or a push in the right direction to find what

you are looking for. What digital forensics tool can you use to

possibly get that hint?

View event logs on the hard disk

Keep looking for that needle in the haystack, it takes time.

Interview the party requesting the investigation

Assign the ticket to the senior technician