EnCase Evidence Processor
The EnCase Evidence Processor is a collection of tools that carry a series of routines necessary to the proper examination of evidence. It is best described as a highly configurable preprocessing tool. Before we start using this tool, we must first make certain we have followed several steps that constitute best practices, namely:
1. Allow EnCase to complete the evidence verification process.
2. Check the verification report to ensure that the verification completed with zero errors and that the acquisition and verification hashes match.
3. Determine the time zone settings for the various evidence items.
4. Adjust EnCase to reflect the time zone offsets as needed; otherwise, EnCase, by default, will assign the time ...
Get EnCE EnCase Computer Forensics: The Official EnCase Certified Examiner Study Guide, 3rd Edition now with the O’Reilly learning platform.
O’Reilly members experience books, live events, courses curated by job role, and more from O’Reilly and nearly 200 top publishers.
