EnCase Evidence Processor

The EnCase Evidence Processor is a collection of tools that carry a series of routines necessary to the proper examination of evidence. It is best described as a highly configurable preprocessing tool. Before we start using this tool, we must first make certain we have followed several steps that constitute best practices, namely:

1. Allow EnCase to complete the evidence verification process.
2. Check the verification report to ensure that the verification completed with zero errors and that the acquisition and verification hashes match.
3. Determine the time zone settings for the various evidence items.
4. Adjust EnCase to reflect the time zone offsets as needed; otherwise, EnCase, by default, will assign the time ...

Get EnCE EnCase Computer Forensics: The Official EnCase Certified Examiner Study Guide, 3rd Edition now with O’Reilly online learning.

O’Reilly members experience live online training, plus books, videos, and digital content from 200+ publishers.