You just started working for a digital forensics firm. Your first few days were spent discussing the importance of maintaining accurate and detailed records with time stamps for admissibility purposes. You have been assigned your first case and will work on it with close support from a senior technician.
The chain of custody record was updated when the item was received into inventory and you updated the chain of custody tag when you opened the secure storage. You took a backup of the disk using DD and ran the image through Autopsy. Returned it to the secure storage and updated the chain of custody tag. At this point you got stuck in your investigation as you have been unable to find anything that was tagged in autopsy as being potentially relevant. You spent hours reviewing the data with no luck. You feel like all you need is a hint or a push in the right direction to find what you are looking for.
What digital forensics tool can you use to possibly get that hint?
