Reconstructing files in context
RHEM Labs uses Digital Autopsy to reconstruct files and examine their context. This helps investigate individual files in relation to Windows internals and other system material, rather than considering a file in isolation.
The forensic question guides the reconstruction and interpretation. Instructions should identify the files or system material at issue, what is already known and what needs to be understood about the surrounding context.
Discuss instructions
Contact RHEM Labs with the question, available material and relevant deadlines. The scope of examination and any limitations are assessed for the particular matter.