Chapter 5
EnCase Concepts
EnCE Exam Topics Covered in This Chapter:
- EnCase evidence file
- CRC, MD5, and SHA-1
- EnCase evidence file format
- New evidence file format
- Evidence file verification
- Hashing disks and volumes
- EnCase case file
- EnCase backup utility
- Configuration, or .INI, files
- Evidence cache folder
This book has made numerous references to the EnCase evidence file. I’ve talked about many of its properties, such as compression, file chunk size, protection via password, MD5 hash, and CRC frequency. In this chapter, I’ll closely examine the evidence file. I’ll describe its major components and its various properties in detail. The evidence file, as you’ll see, is constructed to maintain the authenticity and integrity of the original evidence, ...
Get EnCE EnCase Computer Forensics: The Official EnCase Certified Examiner Study Guide, 3rd Edition now with the O’Reilly learning platform.
O’Reilly members experience books, live events, courses curated by job role, and more from O’Reilly and nearly 200 top publishers.
