Content indexing, for example, is a common task for content focused cases, whereas registry and file system differencing, and time stamp analysis, are common for activity focused cases.eDiscovery and CP case would be examples of content focused investigations, as in such cases the investigator focuses finding files of specific types of content.Intrusion and malware cases are examples of activity f