Difference between revisions of "EnCase"

From ForensicsWiki
Jump to: navigation, search
(File Format)
Line 1: Line 1:
{| cellspacing="2" style="width: 21em; font-size: 85%; text-align: left; float: right; border: 1px solid black; background-color: #eeeeee; padding: 1em;"
+
{{Infobox_Software |
! colspan="2" style="font-size: larger; text-align: center" | Encase
+
  name = EnCase |
|-
+
  maintainer = [http://www.guidancesoftware.com Guidance Software] |
! '''Developer''':
+
  os = [[Windows]] |
| [http://www.guidancesoftware.com Guidance Software]
+
  genre = {{Analysis}} |
|-
+
  license = {{Commercial}} |
| '''OS''':
+
  website = [http://www.guidancesoftware.com www.guidancesoftware.com] |
| [[Microsoft Windows|Windows]]
+
}}
|-
+
! '''Status''':
+
| Active
+
|-
+
! '''Version''':
+
| 6.18
+
|-
+
! '''Genre''':
+
| Forensic Investigation
+
|-
+
! '''Langauge''':
+
| [[English language|English]]
+
|}
+
  
 
'''EnCase''' is a family of all-in-one computer forensics suites sold by [[Guidance Software]]. These products include EnCase Enterprise, EnCase Forensic Edition, EnCase eDiscovery, and EnCase Lab Edition. These programs use a proprietary image file format that has been reverse engineered. Users can create scripts, called [[EnScripts]], to automate tasks.  
 
'''EnCase''' is a family of all-in-one computer forensics suites sold by [[Guidance Software]]. These products include EnCase Enterprise, EnCase Forensic Edition, EnCase eDiscovery, and EnCase Lab Edition. These programs use a proprietary image file format that has been reverse engineered. Users can create scripts, called [[EnScripts]], to automate tasks.  
Line 27: Line 14:
  
 
==Hash Databases==
 
==Hash Databases==
{{main|Encase hash files}}
+
EnCase uses [[MD5]] hashes and stores them in its proprietary [[Encase hash files|Encase hash file format]]; either individually or in a "hash map".
Encase uses [[MD5]] hashes and uses a [[Encase hash files|proprietary file format]] to store them, either singly or in a "hash map". It can also import hashes from the [[National Software Reference Library|NSRL]], [[Hashkeeper]], and plain MD5 files.
+
EnCase supports importing hashes from the [[National Software Reference Library|NSRL]], [[Hashkeeper]], and plain MD5 files.
  
 
== See Also ==
 
== See Also ==
 +
* [[Encase image file format]]
 
* [[EnScripts]]
 
* [[EnScripts]]
 
* [[LinEn]]
 
* [[LinEn]]
 +
* WinEn
  
 
== External Links ==
 
== External Links ==
  
* [http://www.guidancesoftware.com Official website]
+
* [http://www.guidancesoftware.com Guidance Software]
 
* [http://www.safehack.com/Textware/forensic/Anti_Forensic_Break_Encase.pdf Breaking Encase with FILE0 and Winhex]
 
* [http://www.safehack.com/Textware/forensic/Anti_Forensic_Break_Encase.pdf Breaking Encase with FILE0 and Winhex]

Revision as of 23:59, 17 July 2012

EnCase
Maintainer: Guidance Software
OS: Windows
Genre: Analysis
License: Commercial
Website: www.guidancesoftware.com

EnCase is a family of all-in-one computer forensics suites sold by Guidance Software. These products include EnCase Enterprise, EnCase Forensic Edition, EnCase eDiscovery, and EnCase Lab Edition. These programs use a proprietary image file format that has been reverse engineered. Users can create scripts, called EnScripts, to automate tasks.

File Format

See Encase image file format

Hash Databases

EnCase uses MD5 hashes and stores them in its proprietary Encase hash file format; either individually or in a "hash map". EnCase supports importing hashes from the NSRL, Hashkeeper, and plain MD5 files.

See Also

External Links