Tag Archives: EnCase

EnCase 7.1 and FTK 5.5 Tool Evaluation Part 4

Data Generation In order to test and examine the new editions of EnCase and FTK, we need a hard drive with existing data to work with. We want to have something specific to look for when we analyze the drives later on, so we are conducting controlled data generation using computers built for this project […]

Continue reading

EnCase 7.1 and FTK 5.5 Tool Evaluation Part 3

EnCase v7.10 Updates Windows 8.1 and Server 2012 R2 Support EnCase 7.10, EnCase Examiner, SAFE, and the servlet all support Windows 8.1 and Windows Server 2012 R2. Systems running Windows 8.1 via the Evidence Processor (specifically the Windows Artifact parser) and BitLocker encryption are also supported now, and EnCase system requirements and recommended configurations are […]

Continue reading

EnCase 7.1 and FTK 5.5 Tool Evaluation Part 2

EnCase v7.10 Updates EnCase Portable Capabilities EnCase 7.10 comes with full EnCase Portable capabilities. EnCase portable was a standalone product that worked separately from EnCase Forensic and EnCase Enterprise, however, with this update it is now included. EnCase Portable is a USB key based tool that is designed for non-expert and on-scene use. The goal […]

Continue reading

EnCase 7.1 and FTK 5.5 Tool Evaluation Introduction

Project Introduction Over the past few months, Guidance Software and AccessData both released new updates for their computer forensic programs, EnCase and FTK. With EnCase now in update 7.1 and FTK being in 5.5, there are new and updated features that should be looked at. We could also use this opportunity to record how long […]

Continue reading
Five students posing together

CEIC 2014 Student Series: Kayla Williford

Computer Enterprise Investigations Conference (CEIC) 2014 Student Series: Kayla Williford Ever since leaving Las Vegas from CEIC 2014, I’ve been wondering how to describe my time at the conference that undoubtedly changed my life. The days that I spent at CEIC 2014 are now a memory, but what I learned, along with my experiences, will last […]

Continue reading

CEIC 2014 Student Series: Zach Smith

It was  an exciting week in Las Vegas at the Computer and Enterprise Investigations Conference (CEIC) 2014. I would like to say thank you to Guidance Software for putting on the conference and also Champlain College for giving me the opportunity to attend. My flight to Las Vegas left Monday at 6 AM. After traveling […]

Continue reading
Volume Shadow Copy

Volume Shadow Copy Part 3

What we found in the Volume Shadow Copy for Windows 7 After creating a raw image of the Volume Shadow Copy, we were able to view it in both FTK and Encase. We most often used Encase to examine the raw image file and received positive results. We cross referenced the log of what was […]

Continue reading

Treasure Hunting with FTK, EnCase, and SQLite Databases

The last tools we used to examine PirateBrowser, Mozilla 23, and Firefox Portable were EnCase and FTK.  SQLite databases that contained lists of the websites visited, as well as downloads saved by our team were found on each image.  We used a PDF from the SANS blog to assist us in finding the locations of […]

Continue reading
EnCase App Central light blue background

Investigating with the EnCase App

In digital investigations, EnCase is the go-to tool. As Brian Carrier says in his book File System Forensic Analysis, “there are no official numbers on the topic, but it is generally accepted that EnCase is the most widely used computer investigation software.” [ Carrier, Brian. File System Forensic Analysis. Upper Saddle River, NJ [u.a.: Addison-Wesley, 2011. Print.] EnCase is a valid tool for digital investigations, contributing to its popularity. EnCase is a great tool that recently became even more powerful. Continue reading

Painting a Timeline with EnCase

Blog27It has been busy at the LCDI, and we have been focusing on the timeline feature in EnCase and Forensic Tool Kit. Since we have looked into Log2Timeline already, it is hard to compare these other tools that are not as focused on timeline creation as the task specific open source tool is. With that said, here are our findings on timeline capabilities of EnCase and Forensic Tool Kit. Continue reading