EnCase Computer Forensics Demo

This is a short demo of EnCase I worked up. If you are interested in some of what professional computer forensics software can do then this is for you.

Category:

Howto & Style

Tags:

• computer
• forensics
• encase
• encryption
• software
• threesandals

[SAMLAD2k6]

Interesting.. I have a computer I haven't used since I was about 14, and I'm 19 now. So I could maybe see my chat logs from that long ago? + Also could I just ask you that, aside from reformat the computer, does a disk defrag go over all the deleted files you've deleted and actually delete them so they wouldn't show up in any software of this type?

[threesandals]

Nope, a defrag will usually jumble things around pretty good is the drive is heavily fragmented. To really wipe things you need something like "Eraser", for wiping free space, or "Dban" for wiping the whole disk.

[0megamanX]

I'm currently studying computer forensics myself. How much did the program alone cost you?

[threesandals]

Well, it didn't cost *me* anything because I'm resourceful >:->. But I believe that Guidance Software would probably not have any problem sending out a demo copy to a student. I'm not sure if they do demos or not, but it would probably be worth a try.

[alibax007]

Hi! thanks for the tutorial... I was wondering is there any books or videos out there which has more tutorial for new users? or any compant that offer free training? I was looking at the training course in software guidance that they offer and its costs 1000+ for phase1 and another 1000+ for phase2... I cant afford it at the moment because i'm at uni studying Forensic coputing.... and i loads for it as it is....

[threesandals]

Well, you can always download the EnCe Study Guide PDF (or buy the book I suppose). It is the study guide for people working toward Guidance Software's EnCe Encase certification...

[cssbrainDOTcom]

Nothing can't be cracked mate, just a question of time and will...

[rhizophagus]

EnCase and in fact no forensic tools I've seen recently cannot counter the anti-forensic tools eg linux tools, encryption and wiping tools (if done correctly.)

These forensic tools are okay against the user that knows nothing but are useless against the savvy user or even the ordinary user that knows how to google.

[GarrlicSauce]

hey i guttman 35 passed my entire free disc space can shit still be recovered using this program??????????????????

[MyTeffy1]

Apologies for the dumb question, but will this software uncover an originating IP for the data from a USB?

[jesforchrist]

Hello.. Hi.. I just completed my computer forensics degree .... i am trying to upgrade my knowledge in digital forensics. could anyone please advice me whether FTK or Encase.. among these two which is the best course for career... could anyone please let me know... 

[Uuxaul]

@cssbrainDOTcom I disagree sir. I hide all my CP on encrypted virtual machines inside of encrypted file containers, with an AES-Serpant-Twofish algorithm, and keyfiles stored off site.

I Joke I joke!!!

[roboptions]

@threesandals you ARE A JACKASS. The disk defrag will copy all parts of the file somewhere on the hard disk and then write it back to the back of the file before it. It jumbles nothing. If after all the files written to the hard disk you have space that hasnt been used or rewritten. That is the stuff encase will find. If you lucky enough that the evidence was in untouched space than you got it but if not the perp gets off.

[RoadieRon]

@quelorepario whatever.....

[quelorepario]

@RoadieRon bullcrap.

[bishop102]

@threesandals So Could I recover Original Data from a HD that since 2000 has been formatted over15 times?

[RoadieRon]

@skingbinsane very true. They do have many tools. I work in the security field with the us military, law enforcement and also wit hthose often-3-letter-agencies of the us government. autopsy, photorec, C.A.I.N.E, D.E.F.T, EnCase,FTK, scalpel, and many other tools are used. Getting data is important, but Computer Forensics is also largely *HOW* and *WHY* you got the data, lest it not be admissable in a court of law.

[skingbinsane]

@RoadieRon Where did I say it was the "only tool used?" I'm not pulling this info out of thin air, I have talked with a director at a RCFL and was given a brief on the lab at the different platforms used and the main software used... They also use FTK by the way... They have pretty much everything to deal with a hardware and software configuration including every imaginable legacy system you can think of.