Lance Mueller (Magnet Forensics) recently attended CEIC in Orlando, Florida and had the opportunity to meet David Cowen from G-C Partners, LLC. It was great to finally put a face to a name that he has known for some time through his blog and books. Lance has a huge interest in file system forensics, and has been following David’s Tri-Force blog posts and was anxious to hear his scheduled talk on the NTFS Logfile Forensics/Tri-Force during CEIC.
Lance had recently seen a tweet from David where he mentioned using Internet Evidence Finder during the initial stages of his investigative workflow and wanted to ask him a few questions about his overall workflow and where IEF fit within that workflow. He knows the workflow that he is comfortable following, but really appreciates hearing other examiner’s perspectives and reasons for using certain tools at certain times during the examination process.
