Content - Examinations can determine what type of data files are in a computer.
Comparison - Examinations can compare data files to known documents and data files.
Transaction - Examinations can determine the time and sequence that data files were created.
Extraction - Data files can be extracted from the computer.
Deleted Data Files - Deleted data files can be recovered from the computer.
Format Conversion - Data files can be converted from one format to another.
Keyword Searching - Data files can be searched for a word or phrase and all occurrences recorded.
Passwords - Passwords can be recovered and decrypted.
Limited Source Code - Source code can be analyzed and compared.
Storage Media - Storage media used with stand-alone word processors (typewriters) can be examined.