EnCE EnCase Computer Forensics: The Official EnCase Certified Examiner Study Guide, 3rd Edition

Tree Pane Navigation

Let’s navigate within the EnCase environment. In the previous section, you created a case and added a device (I added an evidence file, but you can add your own local hard drive). If you use your own drive, you’ll find that it is an excellent place to explore and to conduct research. Before you can work in the Tree pane, you have to open your evidence item. As you’ll recall, you can double-click the evidence item or select it and click Open on the Evidence tab toolbar. Now you are in the case Entries view, in which the Tree pane displays the devices in your case along with their hierarchical structure down to the folder level. Files contained at any level will be displayed in the Table pane along with any folders at that ...