History on a Computer\ Computer ForensicsLocked
I have a user that wipes his computer clean every time it comes into the IT department. By that I mean he gets rid of all his internet history and recently open docs and programs. They aren’t even in the registry anymore. I know the information is still in the memory of the hard drive somewhere and I need to see what he has been up too. Does anyone have a good program that is not to expensive that will pull this information?
The OS is Windows XP with sp3. It is a Panasonic CF_51 laptop.