by Dr Tristan Jenkinson
In part one we discussed the importance that data from password managers can play. In part two, we look at aspects an investigation may include from a digital forensics perspective.
Finding evidence that a password management tool has been in use could be an important step. It could lead to a request for the relevant details to access the content, or could be used to demonstrate a previous failure to provide details under court order or as part of an agreement. Having an indication of when the manager was installed, how often it was used and when it was last used could be helpful if the usage is questioned.