Computer Forensics and Digital Investigation with EnCase Forensic v7

CHAPTER

3

EnCase Concepts

In this chapter, you are introduced to some of the fundamental concepts you’ll need to be familiar with for using EnCase. They include the case file, which is where EnCase stores the work that you do in your case; the new evidence file format and some of the features that are now available to you; using the encryption options and how to convert legacy evidence files into the new format; and templates, which can be customized to suit the needs of your situation.

The EnCase Case File

When you create a new case and save it ...