EnCase Imager verif...
 
Notifications
Clear all

EnCase Imager verification logs?

Adam10541
(@adam10541)
Senior Member

My googlefu has failed me, anyone know how/if EnCase imager creates verification logs?

Quote
Topic starter Posted : 21/07/2016 9:43 am
jaclaz
(@jaclaz)
Community Legend

My googlefu has failed me, anyone know how/if EnCase imager creates verification logs?

You mean this?

Verifying Evidence Files
Verify Evidence Files checks CRC values of selected files. It is a way to ensure that evidence is not tampered with. Verified CRC information is written out to a log file. From the Evidence tab, you can check the CRC Errors tab in the bottom pane and bookmark any sectors that contain errors.

http//download.guidancesoftware.com/KU%2BE/U1Ix/edkrHovP20INeCqc5ribTB2vJxVDTiToVBaytASWq5Afg5YV/sHF1qdzL82L9O9Y%2Bu7j32H3J6pA%3D%3D

Or - maybe - this?
http//www.forensickb.com/2012/08/encase-enscript-to-verify-lef-colleciton.html

jaclaz

ReplyQuote
Posted : 21/07/2016 5:14 pm
Adam10541
(@adam10541)
Senior Member

Sorry my question was poorly worded.

I used to use EnCase V6 and from memory to get the verification log you had to manually save it after the verification process finished (opposed to Xways which automatically dumps it in the same location as the E01 files). I'm not sure what EnCase V7 does in this regard, however I used EnCase imager the other day and for the life of me can't find the logs or any way to save the log after the verification process finishes.

EnCase imager does go through the verification process but at the conclusion there is no message or any indication one way or another if the verification was successful or not.

My question should have been "Does EnCase imager create verification logs, and if so where/how can I find them?"

ReplyQuote
Topic starter Posted : 26/07/2016 6:38 am
clownboy
(@clownboy)
Junior Member

Add the image to EnCase Imager, the validation starts automatically. The result will be in the lower pane under the Report tab (scroll down.) You can print the report to pdf (right hand side below Lock / Unlock items is a small down arrow, select print.)

ReplyQuote
Posted : 26/07/2016 11:16 am
Adam10541
(@adam10541)
Senior Member

Thanks Clownboy, I am curious though as EnCase imager does verify the image immediately after it's taken will this information be in the same place then, or do you need to re-verify the image to have it visible?

ReplyQuote
Topic starter Posted : 27/07/2016 7:07 am
jpickens
(@jpickens)
Active Member

@Adam. You may want to log this as a defect or enhancement request on the GSI forums. https://support.guidancesoftware.com/forums

ReplyQuote
Posted : 27/07/2016 7:03 pm
Share: