There are always lots of places to start a case.  So of my fellow examiners start at looking at all of the images in a case.  I guess this is a hold over from our old ICAC days.  However somewhere near the top of everyone's list should be the info2 file.  This is the windows life that keeps track of what was placed in the recycle bin and when.  Encase and FTK both provide the native ability to parse this very important file.  The easiest is probably FTK.  It is really as easy as loading the case.  Then going to the explore tab, sorting all of the file names and then looking for info2.  FTK displays your information is a quick and easy to understand format in the top right hand panel.  With Encase you have to sweep stuff and cremoved around - but you can get there.

Just a few notes from an Examiner

David