You have been asked to investigate the possibility of computer fraud in the nance department of a company. It is suspected that a staff member has been committing nance fraud by printing cheques that have not been authorized. You have exhaustively searched all data les on a bitmap image of the target computer, but have found no evidence. You suspect the les may not have been saved.
What should you examine next in this case?
- The registry
- The swap le
- The recycle bin
- The metadata