|
|
| Line 37: |
Line 37: |
| | | | |
| | Is it commercial or open source? Are there other licensing options? | | Is it commercial or open source? Are there other licensing options? |
| | + | |
| | + | == See Also == |
| | + | * [[EnScripts]] |
| | | | |
| | == External Links == | | == External Links == |
Revision as of 07:38, 21 April 2007
Encase is an all-in-one computer forensics suite from Guidance Software Inc.
File Format
Main article Encase image file format
Encase uses a proprietary format for images which is reportedly based on ASR Data's Expert Witness Compression Format. (Source?) The evidence files, or E01 files, contain a physical bitstream of an acquired disk, prefixed with a '"Case Info" header, interlaced with CRCs for every block of 64 sectors~(32 KB), and followed by a footer containing an MD5 hash for the entire bitstream. Contained in the header are the date and time of acquisition, an examiner's name, notes on the acquisition, and an optional password; the header concludes with its own CRC.
Features
File Systems Understood
File Search Facilities
Historical Reconstruction
Can it build timelines and search by creation date?
Searching Abilities
Can it search? Does it build an index? Can it focus on file types or particular kinds of metadata?
Hash Databases
Main article Encase hash files
Encase uses MD5 hashes and uses a proprietary file format to store them. It can also import hashes from the NSRL, Hashkeeper, and plain MD5 files.
Evidence Collection Features
Can it sign files? Does it keep an audit log?
History
Originally written in (YEAR), it has now developed into a Forensic Edition and an Enterprise Edition.
License Notes
Is it commercial or open source? Are there other licensing options?
See Also
External Links
==External Reviews==
