This allows them to collect evidence from Random Access Memory (RAM). Following this, EnCase also provides the option to encrypt the evidence with a secure SHAįorensic Examiners will often also need to require evidence off a live machine, so EnCase provides a feature called the ‘WinEN’ utility. Each image created with EnCase will produce both a CRC and a MD5 hash for future integrity. Another feature of the data acquisition process is the Cyclical Redundancy Checksum (CRC) hash. For example, it creates a directory for evidence files, which contains only the files or folders needed. EnCase also organises files in a sensible and logical order. For example, EnCase provides support for Smartphone and Tablets running the following operating systems Apple iOS, Android OS, Blackberry OS, Palm OS, Symbian and Windows Mobile OS. It is useful to have this feature available to examiners due to the fact that there are many different electronic devices running these different Operating Systems and file systems. Each operating system contains a different amount of file systems which the operating system utilises. Two major features that EnCase boasts are the range of operating systems and file systems supported. EnCase provides useful tools for data acquisition, file recovery and indexing/search file parsing. It provides forensic practitioners with useful features to assist them with efficient, forensically sound data collection and investigation using a repeatable process. EnCase by Guidance Software is an industry-standard computer investigation solution.
0 kommentar(er)
