±Forensic Focus Partners

Become an advertising partner

±Your Account


Username
Password

Forgotten password/username?

Site Members:

New Today: 1 Overall: 35880
New Yesterday: 7 Visitors: 136

±Follow Forensic Focus

Forensic Focus Facebook PageForensic Focus on TwitterForensic Focus LinkedIn GroupForensic Focus YouTube Channel

RSS feeds: News Forums Articles

±Latest Articles

±Latest Videos

±Latest Jobs

Appropriate method for presenting artifacts from an Encase

Forensic software discussion (commercial and open source/freeware). Strictly no advertising.
Reply to topicReply to topic Printer Friendly Page
Forum FAQSearchView unanswered posts
 
  

Geggs
Newbie
 

Appropriate method for presenting artifacts from an Encase

Post Posted: Jun 16, 19 04:11

Hi All,

I'm practicing analyzing an image file using Encase trying to find artifacts which I did. However, what is the most appropriate method for presenting artifacts from the Encase case into a forensic report?



Cheers

GG  
 
  

athulin
Senior Member
 

Re: Appropriate method for presenting artifacts from an Encase

Post Posted: Jun 16, 19 06:38

- Geggs
I'm practicing analyzing an image file using Encase trying to find artifacts which I did. However, what is the most appropriate method for presenting artifacts from the Encase case into a forensic report?


Usually, it's the one that makes the readers of that report able to see the relevant information without any loss of information, and without any ambiguity. And that's in the eyes of the readers.

I have not kept up with recent releases of EnCase, but I'd expect that it still provides its own reporting module. That may be the best thing for the analyst, but it won't help you with disposition, and unintelligent or uninformed use of it will make for singularly unreadable reports.  
 
  

keydet89
Senior Member
 

Re: Appropriate method for presenting artifacts from an Encase

Post Posted: Jun 16, 19 12:27

- Geggs

I'm practicing analyzing an image file using Encase trying to find artifacts which I did. However, what is the most appropriate method for presenting artifacts from the Encase case into a forensic report?



What are your analysis goals? What are you attempting to prove or disprove? Who is your audience?  
 
  

jpickens
Senior Member
 

Re: Appropriate method for presenting artifacts from an Enca

Post Posted: Jun 17, 19 13:09

As a starting point, you could bookmark all your items that you want to be in the report and use the built in report module. From there, I would export to Word and build my report and format it accordingly.  
 
  

kastajamah
Senior Member
 

Re: Appropriate method for presenting artifacts from an Encase

Post Posted: Jun 17, 19 13:18

- keydet89
- Geggs

I'm practicing analyzing an image file using Encase trying to find artifacts which I did. However, what is the most appropriate method for presenting artifacts from the Encase case into a forensic report?



What are your analysis goals? What are you attempting to prove or disprove? Who is your audience?


This is a valid point. Is your audience/stakeholders technical or non-technical? What have they asked you to find? What I have done in the past is, I create a narrative report documenting my process, analysis, and findings. My findings are based on what they have asked for and anything supporting what they have asked for or proving that what they have asked for is not there. I then hyperlink to my report the relevant artifacts that I found in EnCase.  
 

Page 1 of 1