Evidence of categories:

• User Communication
• File Download
• Program Execution
• File Opening/ Creation
• File Knowledge
• Physical Location
• USB Key Usage
• Account Usage
• Browser Usage

Memory and Triage Acquisition

Mounting Disk Images

Filesystem Overview

Data Stream Carving

File Metadata

File Carving