EnCase Layout
Once you’ve loaded the evidence, EnCase provides you with, by default, a Tree-Table view from the Evidence tab. As just stated, this view is quite familiar to veteran EnCase users and will probably be the view most often used, but it is not the only view, which I’ll discuss shortly.
In the Entries Tree-Table view, EnCase divides its screen real estate into three windows that are named for their primary examination function: the Tree pane (formerly the Left pane), the Table pane (formerly the Right pane), and the View pane (formerly the Bottom pane), as shown in Figure 6-6. Granularity or detail increases as you move through the primary panes from the Tree pane to the Table pane and finally to the View pane. If you want details ...
Get EnCE EnCase Computer Forensics: The Official EnCase Certified Examiner Study Guide, 3rd Edition now with the O’Reilly learning platform.
O’Reilly members experience books, live events, courses curated by job role, and more from O’Reilly and nearly 200 top publishers.
