Computer Forensics and Digital Investigation with EnCase Forensic v7

CHAPTER

4

Adding Evidence

This book uses a case study approach in teaching how to use EnCase. Now that we have reached Part II of the book, it is time to introduce you to the case we will use for the rest of the chapters. You should download the evidence so you can follow along with the steps and duplicate the results. Doing so will allow you to become more comfortable with the EnCase interface before you have to apply it to an actual case. After all, trying to become familiar with EnCase in the middle of an active investigation where people are demanding answers is a much more stressful approach—I find it is easier to learn without that pressure. ...