Summary

This chapter covered the EnCase environment and its features and functions. It covered how EnCase organizes its views into increasingly granular content, starting with the Tree pane, moving to the Table pane, and ending with the View pane. What is displayed in any given pane depends on the object highlighted in the pane before it in the hierarchy.

The chapter also covered how to create a case within EnCase from the Home screen and to subsequently add evidence to that case. I discussed how EnCase automatically creates a folder structure to contain the various case files when a new case is created and how to modify the paths for those case and evidence files.

While in the Evidence tab Entries view, the Table pane offers the Table, Gallery, ...

Get EnCE EnCase Computer Forensics: The Official EnCase Certified Examiner Study Guide, 3rd Edition now with the O’Reilly learning platform.

O’Reilly members experience books, live events, courses curated by job role, and more from O’Reilly and nearly 200 top publishers.