Difference between revisions of "EnCase"

From Forensics Wiki
Jump to: navigation, search
 
m
Line 1: Line 1:
 
Encase is an all-in-one computer forensics suite from Guidance Software Inc.
 
Encase is an all-in-one computer forensics suite from Guidance Software Inc.
  
==Features==
+
=File Format=
 +
Perhaps the '''de facto''' standard for forensic analyses in law enforcement, Guidance Software's EnCase Forensic encase} uses a proprietary format for images, reportedly based on ASR Data's Expert Witness Compression Format.  EnCase's Evidence File .E01) format contains a physical bitstream of an acquired disk, prefixed with a '"Case Info" header, interlaced with CRCs for every block of 64 sectors~(32 KB), and followed by a footer containing an MD5 hash for the entire bitstream.  Contained in the header are the date and time of acquisition, an examiner's name, notes on the acquisition, and an optional password; the header concludes with its own CRC.
  
==History==
+
Version 3 of The Encase F introduced an "error2" sections that it uses to record the location and number of bad sector chunks. The way it handles the sections it can't read is that those areas are filled with zero. Then Encase displays to the user the areas that could not be read when the image was acquired. The granularity of unreadably chunks appears to be 32K.
 +
 
 +
 
 +
 
 +
=Features=
 +
 
 +
=History=
  
 
Originally written in (YEAR), it has now developed into a Forensic Edition and an Enterprise Edition.
 
Originally written in (YEAR), it has now developed into a Forensic Edition and an Enterprise Edition.
  
== External Links ==
+
= External Links =
  
 
EnCase Homepage - http://www.guidancesoftware.com/lawenforcement/ef_index.asp
 
EnCase Homepage - http://www.guidancesoftware.com/lawenforcement/ef_index.asp

Revision as of 09:51, 9 December 2005

Encase is an all-in-one computer forensics suite from Guidance Software Inc.

Contents

File Format

Perhaps the de facto standard for forensic analyses in law enforcement, Guidance Software's EnCase Forensic encase} uses a proprietary format for images, reportedly based on ASR Data's Expert Witness Compression Format. EnCase's Evidence File .E01) format contains a physical bitstream of an acquired disk, prefixed with a '"Case Info" header, interlaced with CRCs for every block of 64 sectors~(32 KB), and followed by a footer containing an MD5 hash for the entire bitstream. Contained in the header are the date and time of acquisition, an examiner's name, notes on the acquisition, and an optional password; the header concludes with its own CRC.

Version 3 of The Encase F introduced an "error2" sections that it uses to record the location and number of bad sector chunks. The way it handles the sections it can't read is that those areas are filled with zero. Then Encase displays to the user the areas that could not be read when the image was acquired. The granularity of unreadably chunks appears to be 32K.


Features

History

Originally written in (YEAR), it has now developed into a Forensic Edition and an Enterprise Edition.

External Links

EnCase Homepage - http://www.guidancesoftware.com/lawenforcement/ef_index.asp