±Forensic Focus Partners

Become an advertising partner

±Your Account


Forgotten password/username?

Site Members:

New Today: 0 Overall: 36212
New Yesterday: 2 Visitors: 112

±Follow Forensic Focus

Forensic Focus Facebook PageForensic Focus on TwitterForensic Focus LinkedIn GroupForensic Focus YouTube Channel

RSS feeds: News Forums Articles

±Latest Articles

±Latest Videos

±Latest Jobs

How to find file fragments using EnCase 8

Computer forensics discussion. Please ensure that your post is not better suited to one of the forums below (if it is, please post it there instead!)
Reply to topicReply to topic Printer Friendly Page
Forum FAQSearchView unanswered posts


How to find file fragments using EnCase 8

Post Posted: Apr 23, 19 18:48

Hi there, I started working with EnCase 8.08. At the moment I'm trying to figure out possible ways, how to find artifacts/partial fragments of file on image.

At this point I have raw image (dd), where I presume could have been file with XLSX/XLS or PDF extension, which I'm trying to find, additionally I have original PDF file, I am looking for.

For this task I choose EnCase, because it has something called Intelligent Tail Analysis (correct me if I'm wrong). Are there other ways I could search the files, presuming I have as an example file I'm searching for?

Thank You for Your time in advance! Smile  

Senior Member

Re: How to find file fragments using EnCase 8

Post Posted: Apr 23, 19 19:40


From what you describe I assume you are looking for deleted content and searching the unallocated clusters.

The feature you mention about Intelligent Tail Analysis is part of the File Block Hash Map Analysis enscript, and is available from App Central, at the URL below. Also this works extremely well if you have the sample file/s you are looking for.


As an aside if you were talking about allocated files (or those encase has marked as deleted), the Extents tab of the view pane (lower pane) will list the file fragments of a highlighted file


Page 1 of 1