PART
IV
Putting It All Together
In Part IV, we cover quite a lot of ground. First, Chapter 10 introduces conditions and filters and their uses. The differences between the two are discussed, and you are shown how to run existing conditions and filters, as well as how to make edits to create your own.
Chapter 11 deals primarily with hash libraries and hash sets. You are shown how to create new hash libraries and sets, as well as how to import legacy sets from older versions of EnCase. We also walk through importing the NSRL hash library for use in your cases. Finally, there is a brief discussion on using the timeline function in EnCase.
Get Computer Forensics and Digital Investigation with EnCase Forensic v7 now with the O’Reilly learning platform.
O’Reilly members experience books, live events, courses curated by job role, and more from O’Reilly and nearly 200 top publishers.
