“A big part of my practice is assisting courts and lawyers in cases where it’s alleged that a departing employee has walked off with proprietary data. There’s quite a lot of that. Studies in the U.S. and abroad suggest that some two-thirds of departing white collar employees leave with proprietary data. So, it seems data theft is the norm… This post is offered as a general introduction to selected aspects of Windows Registry and artifact analysis and peculiarities of Windows MAC dates and times. The goal is to introduce you to same, not equip you to conduct forensic exams or march into court assuming this is all you need to know.”

LINK TO ARTICLE