The MS Windows recycle bin differs in Vista from XP. In XP, an deleted file is moved to the "\Recycler\$SID\ folder where "$SID...

Computers, iPods, Thumbdrives, oh My! I've been busy with a major case during which many smaller cases have walked through my door. I b...

iTunes is your friend I have gone from years of computer forensics without ever encountering Apple Products in any meaningful way to seemi...

Identifying Deleted User Accounts in Windows I was recently presented with three laptop computers suspected as stolen. My task was to iden...

I'm moving my content from slo.sleuth.googlepages.com to this blog to make updating and searching for old content easier. Hopefully, I...