Enterprise and FIM Acquisitions
EnCase Forensic allows you to preview and acquire over a network crossover cable, with the length of the crossover cable setting the limit as to how far apart the machines can be. With the EnCase Enterprise (EE) and EnCase Field Intelligence Model (FIM; its end of life is with EnCase 6) editions of EnCase, the preview and acquisition occur over the network and can occur over thousands of miles if need be. In a later release of EnCase 7, EnCase Forensic will have the ability to preview and acquire one machine at a time over the network. The only practical limitation is the speed of the connection. This method of preview and acquisition cuts travel expenses drastically and enables incident-response time to be cut ...
Get EnCE EnCase Computer Forensics: The Official EnCase Certified Examiner Study Guide, 3rd Edition now with the O’Reilly learning platform.
O’Reilly members experience books, live events, courses curated by job role, and more from O’Reilly and nearly 200 top publishers.
