LTEC 2013 - EnCase v7.08.01 presentation
•
3 j'aime•4,456 vues
This document discusses the digital forensic tool EnCase Forensic. It provides an overview of EnCase and its features, including that it is a leading forensic tool accepted in courts. The document then outlines a scenario where EnCase will be used to conduct a forensic investigation based on a search warrant. The remainder of the document walks through the key functions and screens of EnCase like adding disk images, searching for evidence, tagging evidence, and reporting while conducting the outlined forensic investigation scenario.
Recommandé
Contenu connexe
Tendances
Tendances (20)
Similaire à LTEC 2013 - EnCase v7.08.01 presentation
Similaire à LTEC 2013 - EnCase v7.08.01 presentation (20)
Plus de Damir Delija
Plus de Damir Delija (20)
Dernier
Dernier (20)
LTEC 2013 - EnCase v7.08.01 presentation
- 1. EnCase Forensic Digital Forensic Tool Damir Delija, Dr.Sc.E.E. Davorka Foit, mag.ing.inf. et comm.techn. 22. October 2013, LTEC Prague
- 2. EnCase Forensic Leading digital forensics tool • www.guidancesoftware.com Accepted as a standard tool in the judiciary A large number of court rulings and procedures in which EnCase was used It is not necessary to be a computer expert to carry out a standard investigation with EnCase EnCase Forensic – Digital Forensic Tool 2
- 3. Goal The goal is to provide EnCase Forensic hands-on in real usage scenario Scenario: • • • EnCase Forensic – Digital Forensic Tool There is a search warrent which defines what has to be done and how EnCase Forensic will be used Evidence is real 3
- 4. EnCase – main screen EnCase Forensic – Digital Forensic Tool 4
- 5. Writeblocker enabling EnCase Forensic – Digital Forensic Tool 5
- 6. Disk adding EnCase Forensic – Digital Forensic Tool 6
- 7. Disk view - writeBlocked EnCase Forensic – Digital Forensic Tool 7
- 8. Aquisition – creating disk image EnCase Forensic – Digital Forensic Tool 8
- 9. Forensic disk image EnCase Forensic – Digital Forensic Tool 9
- 10. EnCase case folder structure EnCase Forensic – Digital Forensic Tool 10
- 11. Evidence processor – automatic processing EnCase Forensic – Digital Forensic Tool 11
- 12. Main case screen EnCase Forensic – Digital Forensic Tool 12
- 13. Disk view – Tree table view EnCase Forensic – Digital Forensic Tool 13
- 14. Images – Gallery view EnCase Forensic – Digital Forensic Tool 14
- 15. Evidence processor – automatic processing EnCase Forensic – Digital Forensic Tool 15
- 16. Images found EnCase Forensic – Digital Forensic Tool 16
- 17. Image tagging – table view EnCase Forensic – Digital Forensic Tool 17
- 18. Tagging of found evidence: which tag to use EnCase Forensic – Digital Forensic Tool 18
- 19. Timeline view EnCase Forensic – Digital Forensic Tool 19
- 20. Bookmarking of found evidence EnCase Forensic – Digital Forensic Tool 20
- 21. Preliminary report EnCase Forensic – Digital Forensic Tool 21
- 22. Raw search EnCase Forensic – Digital Forensic Tool 22
- 23. Search – keyword definition EnCase Forensic – Digital Forensic Tool 23
- 24. Search results EnCase Forensic – Digital Forensic Tool 24
- 25. Conditions- metadata search EnCase Forensic – Digital Forensic Tool 25
- 26. Index search EnCase Forensic – Digital Forensic Tool 26
- 27. Search results consolidated EnCase Forensic – Digital Forensic Tool 27
- 28. Reporting EnCase Forensic – Digital Forensic Tool 28
- 29. Case backup and archive EnCase Forensic – Digital Forensic Tool 29
- 30. Questions damir.delija@insig2.eu davorka.foit@insig2.eu EnCase Forensic – Digital Forensic Tool 30