Following this they loaded the data into VFC and was able to virtualise the data. Here the triage information provided them full information in relation to the OS and user account. Reviewing the machine in the VM they were able to identify further information about the machine. This included and identified anti-forensic programs installed and in use on the drive.

Without VFC, the previous software would have overlooked all the critical information.