Hypothetical question here.
If we have a CD with multimedia on it. We have reason to believe that
it was accessed on a certain PC. What type of evidence would we find on
the PC running XP Service Pack 2?
Am I right on the following?
1. If a graphics directory is displayed using thumbnails. A thumbs.db
is created within the cache and will remain there afterward.
2. If a graphics file is displayed outright, the file will be copied
into cache and then displayed.
3. If a video file is accessed say via Windows Media Player, the entire
file will be cached on the hard drive.
Any assistance would be greatly appreciated.
Sincerely,
Sol.
