ABSTRACT

It is often the case that the best evidence of fraud or wrongdoing is located not on the organization’s servers, mainframes or central mail systems but on the hard disks of the local workstation used by the suspect.