I'm very new to Encase. Have not worked my first case yet. Am working a test case and have carved JPG and MPEG files from unallocated space. I was able to change the picture column to yes for the JPG files. However, I do not know how to view the MPEG files or if that is even possible. Can I install an external viewer?
If you go to view->file viewers you can add a new one (I recommend VLC), then you can right click the file and send to->vlc.
Carving video from unallocated is a wobbly, sometimes encase will happily carve out a gig of utter staticy rubbish simply because it saw something that might have been an mpeg header, so a little caution, you might find it useful to sort the bookmarked stuff by bookmark length and discount stuff which is 200gb in size.
Thanks for the help.
Not really an answer to your question - but a tool named 'Defraser' is very good for carving video. Use EnCase to mount image as a Network Share then run DeFraser on unallocated clusters, which will appear as a single file within the share.
http//
Good tool!
I have used defraser in the past with limited success but I agree it is a good tool to have in the arsenal.
C4M does an excellent job, too… it's not just for CP.