EnCase Test and Tutorial Page 1


 

EnCase is the industry leading computer forensic software tool used by most all computer forensic examiners world wide. For this test and tutorial I have made 5 folders:

  • Test_Folder-I
  • Test_Folder-II
  • Test_Folder-III
  • Test_Folder-IV
  • Test_Folder-V

All folders contain the same 10 images of various sizes named image01.jpg through image10.jpg

1. -

<img src=EnCase

2. - For Test_Folder-I I'm going to Wipe the images with Eraser v5.3 First I select all of the images | then right click | then choose "Erase".

.EnCase

3. - Before I confirm that I want to Erase the images I choose "Options".

.EnCase

4. - For Test_Folder-I I'm going to use Eraser selecting "3 passes" and also placing a check mark next to "Clutster Tip Area" and "File Names".

.EnCase

5. - Now I choose "Yes" on the "Confirm Erasing" Dialog box.

.EnCase

6. - For Test_Folder-II I'm going to use Eraser v5.3 selecting "3 passes" again but this time I'm going to UnCheck "Clutster Tip Area" and "File Names".

.EnCase

7. - For Test_Folder-III I'm going to use Evidence Eliminator v5.00.0051

.

8. - When I see the EE confimation box I choose "Yes".

.EnCase

9. - For Test_Folder-IV I'm only going to delete the images into the "Recyle Bin" then empty it.

.EnCase

10. - When the confirmation box pops up I choose "Yes".

.EnCase

11. - Now I double click onto the "Recyle Bin" that's on my Desktop | Select all of the images | then choose "File" | then choose "Empty Recyle Bin".

EnCase
 
EnCase Test and Tutorial Page 2
 
Back up
Hosted by www.Geocities.ws

1