EnCase Evidence Processor
The EnCase Evidence Processor is a collection of tools that carry a series of routines necessary to the proper examination of evidence. It is best described as a highly configurable preprocessing tool. Before we start using this tool, we must first make certain we have followed several steps that constitute best practices, namely:
1. Allow EnCase to complete the evidence verification process.
2. Check the verification report to ensure that the verification completed with zero errors and that the acquisition and verification hashes match.
3. Determine the time zone settings for the various evidence items.
4. Adjust EnCase to reflect the time zone offsets as needed; otherwise, EnCase, by default, will assign the time ...