Can forensic analysis find email from web-based email clients, like Yahoo, MSN, or Hotmail?
• Yes. Email composed and read in web-based email clients manifest themselves as visited web pages, which can be retrieved like any other visited web pages. What are file date stamps and how are they used in forensic analysis? There are three dates associated with a file: the date it was created, the date it was last modified, and the date it was last accessed (without modification). • The creation date is the date that the file was created on its current media. When a file is moved from one computer to another, the creation date is changed to the move date. Thus, the creation date is the date that a file was initially created on the current machine. • The modification date is the last time the file was modified on any computer. The modification date is not altered when a file is moved from one computer to another. It changes only when the contents of the file have been changed and saved in some way. • The access date is the date the file was last accessed. In this situation, “access”
