I look is a tough example because the Feds wont let everyone play in their sandbox.
Not even sure why anyone still uses that with all the discounts that LE get on software.
> I look is a tough example because the Feds wont let everyone play in their sandbox.
But why would anyone want to play in their sandbox? It's not sand they're playing in…it's kitty litter. 😉
> Not even sure why anyone still uses that with all the discounts that LE get on software.
ILook is a tool. Like a Barrett .50 cal sniper rifle, it's only as good as the person using it. If someone blindly uses ILook 7.0 to examine a Win98 hard drive with Unicode characters in file and directory names…well, that's their issue as the examiner.
Harlan
I've been using Encase for 3 years. Now I'm facing a situation that two workstation with Encase software show different hash for the same storage device viz. CD-ROM and Floppy. I would like to what will be the cause for this?
I can not see how an image of a floppy or CD will have a different hash value on different machines, unless you have not made an image but are accessing them as a preview. If this is the case there could be a number of reasons why your getting different hashes, not write protecting the floppy may be one, or EnCase is encountering variable bad sectors on either of the devices.
Have you tried posting on the Guidance bbs with the problem, or using the support offered to registered users?