EnCase

From Forensics Wiki
Revision as of 07:13, 6 March 2006 by Pw (Talk | contribs)

Jump to: navigation, search

Encase is an all-in-one computer forensics suite from Guidance Software Inc.

Contents

File Format

Perhaps the de facto standard for forensic analyses in law enforcement, Guidance Software's EnCase Forensic encase} uses a proprietary format for images, reportedly based on ASR Data's Expert Witness Compression Format. EnCase's Evidence File .E01) format contains a physical bitstream of an acquired disk, prefixed with a '"Case Info" header, interlaced with CRCs for every block of 64 sectors~(32 KB), and followed by a footer containing an MD5 hash for the entire bitstream. Contained in the header are the date and time of acquisition, an examiner's name, notes on the acquisition, and an optional password; the header concludes with its own CRC.

Version 3 of The Encase F introduced an "error2" sections that it uses to record the location and number of bad sector chunks. The way it handles the sections it can't read is that those areas are filled with zero. Then Encase displays to the user the areas that could not be read when the image was acquired. The granularity of unreadable chunks appears to be 32K.


Features

File Systems Understood

File Search Facilities

Historical Reconstruction

Can it build timelines and search by creation date?

Searching Abilities

Can it search? Does it build an index? Can it focus on file types or particular kinds of metadata?

Hash Databases

Can it create hashes of files and/or blocks? Can it compare these hash values to any databases? What sort of hash functions does it use?

Evidence Collection Features

Can it sign files? Does it keep an audit log?

History

Originally written in (YEAR), it has now developed into a Forensic Edition and an Enterprise Edition.

License Notes

Is it commercial or open source? Are there other licensing options?

External Links

EnCase Homepage - http://www.guidancesoftware.com/lawenforcement/ef_index.asp

External Reviews
{"cc_re__cc_re__cc_by_sa_3_0": ["<a href=\"/w/index.php?title=EnCase&amp;oldid=1122\" title=\"Permanent link to this revision of the page\">Permanent link</a></li>\n\t\t\t<li id=\"t-info\"><a href=\"/w/index.php?title=EnCase&amp;action=info\">Page information</a></li>\n\t\t</ul>\n\t</div>\n</div>\n\n<!-- /TOOLBOX -->\n\n<!-- LANGUAGES -->\n\n<!-- /LANGUAGES -->\n\t\t\t</div>\n\t\t\t<!-- /panel -->\n\t\t</div>\n\t\t<!-- footer -->\n\t\t<div id=\"footer\" role=\"contentinfo\">\n\t\t\t\t\t\t\t<ul id=\"footer-info\">\n\t\t\t\t\t\t\t\t\t\t\t<li id=\"footer-info-copyright\">Content is available under <a class=\"external\" rel=\"nofollow\" href=\"http://creativecommons.org/licenses/by-sa/3.0/\">Creative Commons Attribution Share Alike</a>.</li>\n\t\t\t\t\t\t\t\t\t</ul>\n\t\t\t\t\t\t\t<ul id=\"footer-places\">\n\t\t\t\t\t\t\t\t\t\t\t<li id=\"footer-places-privacy\"><a href=\"/wiki/Forensics_Wiki:Privacy_policy\" title=\"Forensics Wiki:Privacy policy\">Privacy policy</a></li>\n\t\t\t\t\t\t\t\t\t\t\t<li id=\"footer-places-about\"><a href=\"/wiki/Forensics_Wiki:About\" title=\"Forensics Wiki:About\">About Forensics Wiki</a></li>\n\t\t\t\t\t\t\t\t\t\t\t<li id=\"footer-places-disclaimer\"><a href=\"/wiki/Forensics_Wiki:General_disclaimer\" title=\"Forensics Wiki:", "=\"/wiki/Forensics_Wiki:Privacy_policy\" title=\"Forensics Wiki:Privacy policy\">Privacy policy</a></li>\n\t\t\t\t\t\t\t\t\t\t\t<li id=\"footer-places-about\"><a href=\"/wiki/Forensics_Wiki:About\" title=\"Forensics Wiki:About\">About Forensics Wiki</a></li>\n\t\t\t\t\t\t\t\t\t\t\t<li id=\"footer-places-disclaimer\"><a href=\"/wiki/Forensics_Wiki:General_disclaimer\" title=\"Forensics Wiki:General disclaimer\">Disclaimers</a></li>\n\t\t\t\t\t\t\t\t\t</ul>\n\t\t\t\t\t\t\t\t\t\t<ul id=\"footer-icons\" class=\"noprint\">\n\t\t\t\t\t<li id=\"footer-copyrightico\">\n\t\t\t\t\t\t<a href=\"http://creativecommons.org/licenses/by-sa/3.0/\"><img src=\"/w/skins/common/images/cc-by-sa.png\" alt=\"Creative Commons Attribution Share Alike\" width=\"88\" height=\"31\" /></a>\n\t\t\t\t\t</li>\n\t\t\t\t\t<li id=\"footer-poweredbyico\">\n\t\t\t\t\t\t<a href=\"//www.mediawiki.org/\"><img src=\"/w/skins/common/images/poweredby_mediawiki_88x31.png\" alt=\"Powered by MediaWiki\" width=\"88\" height=\"31\" /></a>\n\t\t\t\t\t</li>\n\t\t\t\t</ul>\n\t\t\t\t\t\t<div style=\"clear:both\"></div>\n\t\t</div>\n\t\t<!-- /footer -->\n\t\t<script>if(window.mw){\nmw.loader.state({\"site\":\"loading\",\"user\":\"missing\",\"user.grou"], "copyright__copyright__copyright": ["", "f files and/or blocks? Can it compare these hash values to any databases? What sort of hash functions does it use?\n\nEvidence Collection Features\n\nCan it sign files? Does it keep an audit log?\n\nHistory\n\nOriginally written in (YEAR), it has now developed into a Forensic Edition and an Enterprise Edition.\n\nLicense Notes\n\nIs it commercial or open source? Are there other licensing options?\n\nExternal Links\n\nEnCase Homepage - http://www.guidancesoftware.com/lawenforcement/ef_index.asp\n\nExternal Reviews", "f files and/or blocks? Can it compare these hash values to any databases? What sort of hash functions does it use?\n\nEvidence Collection Features\n\nCan it sign files? Does it keep an audit log?\n\nHistory\n\nOriginally written in (YEAR), it has now developed into a Forensic Edition and an Enterprise Edition.\n\nLicense Notes\n\nIs it commercial or open source? Are there other licensing options?\n\nExternal Links\n\nEnCase Homepage - http://www.guidancesoftware.com/lawenforcement/ef_index.asp\n\nExternal Reviews"]}