From ForensicsWiki
Revision as of 14:51, 9 December 2005 by Simsong (Talk | contribs)

Jump to: navigation, search

Encase is an all-in-one computer forensics suite from Guidance Software Inc.

File Format

Perhaps the de facto standard for forensic analyses in law enforcement, Guidance Software's EnCase Forensic encase} uses a proprietary format for images, reportedly based on ASR Data's Expert Witness Compression Format. EnCase's Evidence File .E01) format contains a physical bitstream of an acquired disk, prefixed with a '"Case Info" header, interlaced with CRCs for every block of 64 sectors~(32 KB), and followed by a footer containing an MD5 hash for the entire bitstream. Contained in the header are the date and time of acquisition, an examiner's name, notes on the acquisition, and an optional password; the header concludes with its own CRC.

Version 3 of The Encase F introduced an "error2" sections that it uses to record the location and number of bad sector chunks. The way it handles the sections it can't read is that those areas are filled with zero. Then Encase displays to the user the areas that could not be read when the image was acquired. The granularity of unreadably chunks appears to be 32K.



Originally written in (YEAR), it has now developed into a Forensic Edition and an Enterprise Edition.

External Links

EnCase Homepage - http://www.guidancesoftware.com/lawenforcement/ef_index.asp