To try this out using the EnCase Evidence Processor, select the 'File Carver' module.
This is especially important in cases involving visual evidence (e.g. While EnCase is not normally valued for its carving abilities (in fact, it is often criticised for its performance with this function), it does often outperform many competing tools on carving image files. This is done via the identification of the header and trailer/footer codes associated with certain file types and is a core skill that should be mastered by digital forensic specialists. This article picks out three areas where EnCase can claim an advantage over its rivals and contributes to its strong reputation in both digital forensics and proactive cyber security.Ĭarving is the process by which discrete files are separated from other information in unallocated disc space. It is often one of the first pieces of software employed when digital documents need to be thoroughly investigated.īut what is so special about EnCase? Wouldn't other, less well known tools uncover the same types of information EnCase has been able to? After all, there are plenty of alternatives (FTK, Oxygen, X-Ways, Helix, Winhex, Logicube Talon, Replica, etc.) and most forensic specialists will use a number of different tools depending on the use case. If you are a digital forensics specialist or enthusiast, you will no doubt have come across the EnCase tool. What Can EnCase Identify That Other Digital Forensics Tools Can't?
0 kommentar(er)
