15. Common Questions and Tasks

In some cases, a forensic examination is just about finding a picture, text, or e-mail. However, it is very common that the forensic expert is tasked with answering more complex questions such as determining who the user of a computer is or if a computer was remote controlled. While providing a definite answer to such a question is often almost impossible, this chapter introduces three methods that can be used to tackle those requests. First, analysis of applications is an attempt to complete a deep examination of applications related to a specific task, for instance, remote controlling computers. The idea is that analyzing the computer for any trace of such software could provide an indication of whether it existed or not. The next method is scenario testing where the forensic expert tries to find evidence that is in favor of, or disproves, a stated scenario. The final method, useful for tying a person to some action, is timelining where the forensic expert tries to cross-reference criminal actions with actions that can identify the computer user.