First Looks: Basic Investigations of Windows Vista. Lance Mueller email@example.com. Example Evidence File. Please start EnCase load the sample Windows Vista EnCase evidence file. The Evidence file is located here: C:\Evidence\Mueller
Common location for VBR using a hard drive with 63SPT. (PS63)
New location of VBR in Vista (PS2048)
There are now approximately 30 different event logs that Windows Vista reports events to. Currently these logs can only be read by the native Windows Vista Event Viewer (eventvwr), although an EnCase EnScript is under development.