You approach a computer of a knowledgeable computer user who says "you're never going to find anything! I used truecrypt" (a once popular open source software package for encrypting files). You realize the computer is open and logged in. Upon responding, assuming you have proper search authority - what should you do FIRST?
O Acquire forensic hard disk images Acquire Random Access Memory (RAM) in accordance with the order of volatility.
O Obtain logs from the Internet Service Provider Abandon the search, as truecrypt will foil any hope of finding evidence.