EnCase also has the tools needed to gather evidence from popular email clients such as Yahoo, Hotmail, Netscape and Outlook.ĮnCase generates automatic reports which can be used as evidence in a court of law. Furthermore there are toolkits used to examine applications such as Kazaa (a popular Peer-To-Peer client), as well as Instant Messenger Toolkits. There are also other tools used in the processing of HTML pages, such as the HTML Carver. There is also a HTML page reconstruction feature which will re-build HTML code into a user-friendly page for viewing. EnCase allows the recovery and viewing of the browser activity, including internet artifacts, history and cache. Following this, EnCase also provides the option to encrypt the evidence with a secure SHAĪ critical feature is the Internet and Email Investigation tools. Each image created with EnCase will produce both a CRC and a MD5 hash for future integrity. Another feature of the data acquisition process is the Cyclical Redundancy Checksum (CRC) hash. For example, it creates a directory for evidence files, which contains only the files or folders needed.
EnCase also organises files in a sensible and logical order. For example, EnCase provides support for Smartphone and Tablets running the following operating systems Apple iOS, Android OS, Blackberry OS, Palm OS, Symbian and Windows Mobile OS. It is useful to have this feature available to examiners due to the fact that there are many different electronic devices running these different Operating Systems and file systems. Each operating system contains a different amount of file systems which the operating system utilises. Two major features that EnCase boasts are the range of operating systems and file systems supported. EnCase provides useful tools for data acquisition, file recovery and indexing/search file parsing. It provides forensic practitioners with useful features to assist them with efficient, forensically sound data collection and investigation using a repeatable process. Bibliography Section 1 – Forensic Software EvaluationĮnCase by Guidance Software is an industry-standard computer investigation solution.
0 kommentar(er)
