I have this file link And I need to find evidence using FTKImager to find evidence of accessing “notable document.rft”. But I don't know how. I've opened the file and I see the other files that are located in Unallocated Space. I know the offset of accessing a file is 36-8 Bytes. Any help is appreciated

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.