You have been asked to investigate the possibility of computer fraud in the finance department of a company. It is suspected that a staff member has been committing finance fraud by printing cheques that have not been authorized. You have exhaustively searched all data files on a bitmap image of the target computer, but have found no evidence. You suspect the files may not have been saved. What should you examine next in this case?

Question

Quizplus · Accepted Answer

The swap file may contain remnants of data that were in memory but not saved to disk, potentially revealing unauthorized activities.

You Have Been Asked to Investigate the Possibility of Computer