Putting It All Together
Together we have covered the gamut of the major features of EnCase 7. The order in which we have proceeded was largely determined by the most logical learning progression, which has no connection to the order in which you might conduct a forensic examination. So, what is the best order in which to conduct a forensic examination? Clearly, there are a few basic steps that progress in a certain sequence, but beyond that, the order is most often determined by the examiner based on the nature and urgency of the case.
Over the years, many examiners have asked for a list of suggested steps for an examination. Over time, with input and suggestions from many colleagues, I have assembled such a list. It should never be regarded ...
Get EnCE EnCase Computer Forensics: The Official EnCase Certified Examiner Study Guide, 3rd Edition now with the O’Reilly learning platform.
O’Reilly members experience books, live events, courses curated by job role, and more from O’Reilly and nearly 200 top publishers.
