I am new to Forensics and was wondering if anyone know the answer to these questions
1. You have a custodian and they copied some information to an external drive but you are not sure which external drive it is on and they gave you 5 ext drive and 1 thumb drive…in Encase how can you tell which drive the data was copied too by a specific person?
2. You are doing a copy from laptop to laptop and you need to find exactly what ext drive the data was copied too but without Encase how can you tell where the data was copied too and by whom?