What is the difference between a System Preview and a full Forensic Analysis?
A system preview is a simple procedure to perform electronic discovery on a device that you suspect has certain predetermined information. This can include IM chat logs, e-mails, pictures, videos…almost anything. This can be useful to randomly spot check an individual on probation or parole for specific violations, monitor a family members computer and internet use, quickly search for policy violations such as inappropriate use or theft of bandwidth in a corporate environment, or to verify infidelity over the internet…and the list goes on. This is also very valuable in determining if a full Digital Forensic Analysis is necessary. If you suspect misconduct but don’t know specifically what data you are looking for, a System Preview may provide the necessary catalyst data that provides information that leads to even deeper evidence, warranting a full-blown Digital Forensic Investigation. While forensic evidence procedures are always followed and documented so the evidence can be used
