Difference between revisions of "EnCase"
From Forensics Wiki
Joachim Metz (Talk | contribs) (→File Format) |
Joachim Metz (Talk | contribs) |
||
| Line 1: | Line 1: | ||
| − | {| | + | {{Infobox_Software | |
| − | + | name = EnCase | | |
| − | + | maintainer = [http://www.guidancesoftware.com Guidance Software] | | |
| − | + | os = [[Windows]] | | |
| − | + | genre = {{Analysis}} | | |
| − | | | + | license = {{Commercial}} | |
| − | + | website = [http://www.guidancesoftware.com www.guidancesoftware.com] | | |
| − | + | }} | |
| − | | | + | |
| − | + | ||
| − | | | + | |
| − | | | + | |
| − | + | ||
| − | + | ||
| − | | | + | |
| − | + | ||
| − | + | ||
| − | + | ||
| − | + | ||
| − | + | ||
| − | + | ||
'''EnCase''' is a family of all-in-one computer forensics suites sold by [[Guidance Software]]. These products include EnCase Enterprise, EnCase Forensic Edition, EnCase eDiscovery, and EnCase Lab Edition. These programs use a proprietary image file format that has been reverse engineered. Users can create scripts, called [[EnScripts]], to automate tasks. | '''EnCase''' is a family of all-in-one computer forensics suites sold by [[Guidance Software]]. These products include EnCase Enterprise, EnCase Forensic Edition, EnCase eDiscovery, and EnCase Lab Edition. These programs use a proprietary image file format that has been reverse engineered. Users can create scripts, called [[EnScripts]], to automate tasks. | ||
| Line 27: | Line 14: | ||
==Hash Databases== | ==Hash Databases== | ||
| − | + | EnCase uses [[MD5]] hashes and stores them in its proprietary [[Encase hash files|Encase hash file format]]; either individually or in a "hash map". | |
| − | + | EnCase supports importing hashes from the [[National Software Reference Library|NSRL]], [[Hashkeeper]], and plain MD5 files. | |
== See Also == | == See Also == | ||
| + | * [[Encase image file format]] | ||
* [[EnScripts]] | * [[EnScripts]] | ||
* [[LinEn]] | * [[LinEn]] | ||
| + | * WinEn | ||
== External Links == | == External Links == | ||
| − | * [http://www.guidancesoftware.com | + | * [http://www.guidancesoftware.com Guidance Software] |
* [http://www.safehack.com/Textware/forensic/Anti_Forensic_Break_Encase.pdf Breaking Encase with FILE0 and Winhex] | * [http://www.safehack.com/Textware/forensic/Anti_Forensic_Break_Encase.pdf Breaking Encase with FILE0 and Winhex] | ||
Revision as of 23:59, 17 July 2012
| EnCase | |
|---|---|
| Maintainer: | Guidance Software |
| OS: | Windows |
| Genre: | Analysis |
| License: | Commercial |
| Website: | www.guidancesoftware.com |
EnCase is a family of all-in-one computer forensics suites sold by Guidance Software. These products include EnCase Enterprise, EnCase Forensic Edition, EnCase eDiscovery, and EnCase Lab Edition. These programs use a proprietary image file format that has been reverse engineered. Users can create scripts, called EnScripts, to automate tasks.
Contents |
File Format
Hash Databases
EnCase uses MD5 hashes and stores them in its proprietary Encase hash file format; either individually or in a "hash map". EnCase supports importing hashes from the NSRL, Hashkeeper, and plain MD5 files.
