Hopefully I am posting this in the correct topic. I have been doing technical consulting for a number of years now, primarily doing database development, small business networking and web development. Recently, one of my clients, for whom I had developed a custom customer contact system, was forced to fire one of their employees. I don't know the details of why this individual was fired, but I gather there are some fairly serious allegations. I was asked by this client to do an analysis of the fired employee's workstation computer. They would like me to: recover any emails which might have been sent, do an anlaysis of recent web activity, and recover anything else which might potentially be part of a legal case against this employee if such becomes necessary in the future. I have never been asked to do such an analysis before, and although I'm fairly technically savvy, I'm not sure how to approach this assignment. I'm hoping to get some advice regarding what I should be looking for, any utilities (best if they are free) which might help me with such an analysis, and what areas of the system might contain the information I'd be looking for. The computer I'm looking at has Vista Business Edition loaded, and Internet Explorer and MS Office are the primary applications used. Any advice or suggestions would be greatly appreciated. Thanks in advance for your help! --e
This is a tricky one. Not intending to be rude or arrogant, but what you are asking for is free, expert-level consulting advice so that you can get paid for it. To me, that's not entirely fair. That being said, here's my friendly advice to you: If you are very honest, you can subcontract a security firm with some experience in this field to give you an expert analysis of the system. If not, you will have to Google some computer forensics articles and hope for the best.
