Difference between revisions of "EnCase"

From Forensics Wiki
Jump to: navigation, search
(Cleaned up and wikified)
Line 1: Line 1:
{{Wikify}}
+
'''EnCase''' is a family of all-in-one computer forensics suites sold by [[Guidance Software]]. These products include EnCase Enterprise, EnCase Forensic Edition, EnCase eDiscovery, and EnCase Lab Edition. These programs use a proprietary image file format that has been reverse engineered. Users can create scripts, called [[EnScripts]], to automate tasks.  
 
+
Encase is an all-in-one computer forensics suite from Guidance Software Inc.
+
  
 
== File Format ==
 
== File Format ==
 
{{main|Encase image file format}}
 
{{main|Encase image file format}}
 
Encase uses a proprietary format for images which is reportedly based on ASR Data's Expert Witness Compression Format. (Source?) The evidence files, or E01 files, contain a physical bitstream of an acquired disk, prefixed with a '"Case Info" header, interlaced with CRCs for every block of 64 sectors~(32 KB), and followed by a footer containing an MD5 hash for the entire bitstream.  Contained in the header are the date and time of acquisition, an examiner's name, notes on the acquisition, and an optional password; the header concludes with its own CRC.
 
Encase uses a proprietary format for images which is reportedly based on ASR Data's Expert Witness Compression Format. (Source?) The evidence files, or E01 files, contain a physical bitstream of an acquired disk, prefixed with a '"Case Info" header, interlaced with CRCs for every block of 64 sectors~(32 KB), and followed by a footer containing an MD5 hash for the entire bitstream.  Contained in the header are the date and time of acquisition, an examiner's name, notes on the acquisition, and an optional password; the header concludes with its own CRC.
 
 
=Features=
 
 
==File Systems Understood==
 
 
==File Search Facilities==
 
 
==Historical Reconstruction==
 
 
Can it build timelines and search by creation date?
 
 
==Searching Abilities==
 
 
Can it search? Does it build an index? Can it focus on file types or particular kinds of metadata?
 
  
 
==Hash Databases==
 
==Hash Databases==
 
{{main|Encase hash files}}
 
{{main|Encase hash files}}
 
Encase uses [[MD5]] hashes and uses a [[Encase hash files|proprietary file format]] to store them. It can also import hashes from the [[National Software Reference Library|NSRL]], [[Hashkeeper]], and plain MD5 files.
 
Encase uses [[MD5]] hashes and uses a [[Encase hash files|proprietary file format]] to store them. It can also import hashes from the [[National Software Reference Library|NSRL]], [[Hashkeeper]], and plain MD5 files.
 
==Evidence Collection Features==
 
 
Can it sign files? Does it keep an audit log?
 
 
== History ==
 
 
Originally written in (YEAR), it has now developed into a Forensic Edition and an Enterprise Edition.
 
 
==License Notes==
 
 
Is it commercial or open source? Are there other licensing options?
 
  
 
== See Also ==
 
== See Also ==
Line 46: Line 17:
 
* [http://www.guidancesoftware.com/products/ee_index.aspx Official website]
 
* [http://www.guidancesoftware.com/products/ee_index.aspx Official website]
 
* [http://www.safehack.com/Textware/forensic/Anti_Forensic_Break_Encase.pdf Breaking Encase with FILE0 and Winhex]
 
* [http://www.safehack.com/Textware/forensic/Anti_Forensic_Break_Encase.pdf Breaking Encase with FILE0 and Winhex]
 
==External Reviews==
 

Revision as of 19:27, 2 June 2008

EnCase is a family of all-in-one computer forensics suites sold by Guidance Software. These products include EnCase Enterprise, EnCase Forensic Edition, EnCase eDiscovery, and EnCase Lab Edition. These programs use a proprietary image file format that has been reverse engineered. Users can create scripts, called EnScripts, to automate tasks.

Contents

File Format

Encase uses a proprietary format for images which is reportedly based on ASR Data's Expert Witness Compression Format. (Source?) The evidence files, or E01 files, contain a physical bitstream of an acquired disk, prefixed with a '"Case Info" header, interlaced with CRCs for every block of 64 sectors~(32 KB), and followed by a footer containing an MD5 hash for the entire bitstream. Contained in the header are the date and time of acquisition, an examiner's name, notes on the acquisition, and an optional password; the header concludes with its own CRC.

Hash Databases

Main article Encase hash files

Encase uses MD5 hashes and uses a proprietary file format to store them. It can also import hashes from the NSRL, Hashkeeper, and plain MD5 files.

See Also

External Links