8.2. Defeating Algorithms, Hashes, and Keys

When you encounter evidence that has been hidden in some way, your first decision is to decide how it was hidden. Was steganography used, or was the suspect using Windows Encrypting File System (EFS)? Much depends on what you find because if you use the wrong tools to attempt an extraction, you waste a lot of time and might even accidentally destroy your evidence.