A question about browser history

[dagershman_dgt at dagertech.net (David A. Gershman)]

> > anyone knows of a way this could have happened which backs up the
employee's
> > story or do I just go ahead and assume guilt?

First (IMHO)
Don't assume guilt or innocence.  Stick to what you were asked...find
evidence if its there.  If its not there, fine.  Start assuming anything
or taking the employee's "nature" into account and you're doing the
manager's/company's job.  If this employee gets fired for an
'assumption', you'll feel it.  Provide the best evidence you can and let
the verdict reside with the company.

I know it sounds cold, but when doing forensics its important to remain
as objective as possible.

Second
As for how their history could have been populated, I really have no
idea.  I do know this, don't just look within the browser.  A good piece
of malware coming from a thumbdrive could screw with browser files just
as easily.  Be sure to scour the big picture.

----------------------------------------
David A. Gershman
gershman at dagertech.net
http://dagertech.net/gershman/
"It's all about the path!" --d. gershman