Difference between revisions of "EnCase"
From Forensics Wiki
Joachim Metz (Talk | contribs) |
|||
| (32 intermediate revisions by 12 users not shown) | |||
| Line 1: | Line 1: | ||
| − | + | {{Infobox_Software | | |
| + | name = EnCase | | ||
| + | maintainer = [http://www.guidancesoftware.com Guidance Software] | | ||
| + | os = [[Windows]] | | ||
| + | genre = {{Analysis}} | | ||
| + | license = {{Commercial}} | | ||
| + | website = [http://www.guidancesoftware.com www.guidancesoftware.com] | | ||
| + | }} | ||
| − | + | '''EnCase''' is a family of all-in-one computer forensics suites sold by [[Guidance Software]]. These products include EnCase Enterprise, EnCase Forensic Edition, EnCase eDiscovery, and EnCase Lab Edition. These programs use a proprietary image file format that has been reverse engineered. Users can create scripts, called [[EnScripts]], to automate tasks. | |
| − | ==History== | + | == History == |
| + | Expert Witness (for Windows) was the original name for EnCase (dating back to 1998). More info about this can be found on the Internet Archive [http://web.archive.org/web/19980504153628/http://guidancesoftware.com/] including a demo of the original software [http://web.archive.org/web/19980504153759/http://guidancesoftware.com/data/ewsetup.exe]. | ||
| − | + | == File Format == | |
| + | See [[Encase image file format]] | ||
| + | |||
| + | == Hash Databases == | ||
| + | EnCase uses [[MD5]] hashes and stores them in its proprietary [[Encase hash files|Encase hash file format]]; either individually or in a "hash map". | ||
| + | EnCase supports importing hashes from the [[National Software Reference Library|NSRL]], [[Hashkeeper]], and plain MD5 files. | ||
| + | |||
| + | == See Also == | ||
| + | * [[Encase image file format]] | ||
| + | * [[EnScripts]] | ||
| + | * [[LinEn]] | ||
| + | * WinEn | ||
== External Links == | == External Links == | ||
| − | + | * [http://www.guidancesoftware.com Guidance Software] | |
| + | * [http://www.safehack.com/Textware/forensic/Anti_Forensic_Break_Encase.pdf Breaking Encase with FILE0 and Winhex] | ||
Latest revision as of 01:24, 21 July 2012
| EnCase | |
|---|---|
| Maintainer: | Guidance Software |
| OS: | Windows |
| Genre: | Analysis |
| License: | Commercial |
| Website: | www.guidancesoftware.com |
EnCase is a family of all-in-one computer forensics suites sold by Guidance Software. These products include EnCase Enterprise, EnCase Forensic Edition, EnCase eDiscovery, and EnCase Lab Edition. These programs use a proprietary image file format that has been reverse engineered. Users can create scripts, called EnScripts, to automate tasks.
Contents |
[edit] History
Expert Witness (for Windows) was the original name for EnCase (dating back to 1998). More info about this can be found on the Internet Archive [1] including a demo of the original software [2].
[edit] File Format
[edit] Hash Databases
EnCase uses MD5 hashes and stores them in its proprietary Encase hash file format; either individually or in a "hash map". EnCase supports importing hashes from the NSRL, Hashkeeper, and plain MD5 files.
