27. Local Drive Analysis

• Same process as disk images:

  • Scan for Volumes

  • Scan for File Systems

  • Add files to database

• Will need to run as administrator to access all drives.

• Analysis cannot be performed if USB device is removed