EnCase Forensic 8 w...
 
Notifications
Clear all

EnCase Forensic 8 word search file types

6 Posts
5 Users
0 Likes
2,136 Views
dFletchmann
(@dfletchmann)
Posts: 2
New Member
Topic starter
 

?To EnCase Forensic version 8 users, I'm converting from version 6. Can version 8 handle *.docx, *.xlsx files without having to save the older file type to do a valid scan, like I had to do with version 6? I do multiple scans every day, using up to 1,000 words or phrases from my master word list, analyzing up to 800.000 hits per scan, which is the main reason for using EnCase. The user manual doesn't help answer this, and Guidance Sofware Tech Support phones always seem to be busy.

 
Posted : 24/01/2017 11:01 pm
(@hommy0)
Posts: 98
Trusted Member
 

In versions 8 (and 7) if you index the evidence using the evidence processor, you will then be able to perform an index search for keywords/phrases in Office 2007 -> file types (docx, xlsx etc).

You can also index a Result Set (or a logical evidence file) where your result set (or LEF) contains just the file types of interest.

 
Posted : 25/01/2017 2:40 am
dFletchmann
(@dfletchmann)
Posts: 2
New Member
Topic starter
 

hommy0 - Thank you for your reply post. That really helps. Moving from 6 to 8 is a real pain, but since 6 and 7 aren't supported anymore, I'm having to work with a steep learning curve. Thanks.

 
Posted : 25/01/2017 3:45 am
minime2k9
(@minime2k9)
Posts: 481
Honorable Member
 

If your having to change to Encase 8, change to X-Ways and you'll never look back )

 
Posted : 25/01/2017 12:01 pm
jpickens
(@jpickens)
Posts: 130
Estimable Member
 

hommy0 - Thank you for your reply post. That really helps. Moving from 6 to 8 is a real pain, but since 6 and 7 aren't supported anymore, I'm having to work with a steep learning curve. Thanks.

version 7 is still supported, however you need to make sure your maintenance has not expired for your dongle/e-license.

 
Posted : 25/01/2017 7:22 pm
pbobby
(@pbobby)
Posts: 239
Estimable Member
 

If your having to change to Encase 8, change to X-Ways and you'll never look back )

Heh, unless you've got encrypted drives then check your rear-view mirror.

 
Posted : 25/01/2017 10:08 pm
Share: