Difference between revisions of "EnCase"

From ForensicsWiki
Jump to: navigation, search
(Hash Databases)
m (Corrected URL to Official website, was pointing to an outdated page)
Line 15: Line 15:
== External Links ==
== External Links ==
* [http://www.guidancesoftware.com/products/ee_index.aspx Official website]
* [http://www.guidancesoftware.com Official website]
* [http://www.safehack.com/Textware/forensic/Anti_Forensic_Break_Encase.pdf Breaking Encase with FILE0 and Winhex]
* [http://www.safehack.com/Textware/forensic/Anti_Forensic_Break_Encase.pdf Breaking Encase with FILE0 and Winhex]

Revision as of 21:28, 3 March 2011

EnCase is a family of all-in-one computer forensics suites sold by Guidance Software. These products include EnCase Enterprise, EnCase Forensic Edition, EnCase eDiscovery, and EnCase Lab Edition. These programs use a proprietary image file format that has been reverse engineered. Users can create scripts, called EnScripts, to automate tasks.

File Format

Encase uses a proprietary format for images which is reportedly based on ASR Data's Expert Witness Compression Format. (Source?) The evidence files, or E01 files, contain a physical bitstream of an acquired disk, prefixed with a '"Case Info" header, interlaced with CRCs for every block of 64 sectors~(32 KB), and followed by a footer containing an MD5 hash for the entire bitstream. Contained in the header are the date and time of acquisition, an examiner's name, notes on the acquisition, and an optional password; the header concludes with its own CRC.

Hash Databases

Main article Encase hash files

Encase uses MD5 hashes and uses a proprietary file format to store them, either singly or in a "hash map". It can also import hashes from the NSRL, Hashkeeper, and plain MD5 files.

See Also

External Links