The EnCase Forensic GUI
|
|
"Conditions" permit users to quickly create complex, multifaceted filters, without any knowledge of the EnScript® programming language. |
The block size and error granularity settings interface. |
The LinEn acquisition tool can be easily added to any Linux computer forensic floppy or boot CD. |
Unicode support allowing for the display of character-based languages. |
"Single Files" allows an examiner to drag and drop particular files of interest into EnCase for analysis. |
"Logical Evidence Files" can be created and locked from "Single Files," as well as from specific files of interest from an EnCase preview of subject media. |
Logical partitions can be renamed to properly label diagnostic or hidden partitions. |
EnCase Forensic provides support for the display of jfs and JFS file systems for AIX. |
Display for email messages and attachments. |
The email header information can be displayed or not, with "Show Header." |
Email attachments are easy to view. |
Internet history support for Internet Explorer, Mozilla, Opera and Macintosh Safari. |
Web cache analysis support for Internet Explorer, Mozilla, Opera, and Macintosh Safari. |
The Sweep Case EnScript automates investigations by permitting other EnScripts to be called and ran. |
