|
Question: For each file, what processes were taken by the suspect to mask them from others?
Answer: Cover page.jpg - misrepresented
File extension "jpg" was changed to "jpgc".
Starting cluster was changed from "42" to "420". No data found at cluster 420.
Password "goodtimes" found in slack space of data.
|
|