Anyone else distinctly underwhelmed by the the prospect of the imminent release of EnCase 6?
Just a suggestion, but perhaps it would have been better to concentrate on making EnCase 5 work before adding yet more bells and whistles…
It is business (
I'm still working with version 4.
Last time I checked it was pretty expensive to upgrade to V5 from V4, but I could have been misinformed.
I am waiting on FTK 2
I'm still working with version 4.
Last time I checked it was pretty expensive to upgrade to V5 from V4, but I could have been misinformed.
I am waiting on FTK 2
I (and the rest of my colleagues) all prefer 4.22 over 5; however we are 'forcing' ourselves to use 5 as that is where the support and development lies.
Like you, and a lot of people, we're looking forward to FTK 2.0. I've been in contact with Access Data's Director of Training about its release date - nothing firm as yet as it seems they are waiting for it to be ready before releasing it (are you listening Guidance? wink )
Today I saw V6 from my colleagues
i am using encase 6 right now as we speak. the index function does not work, it crashes out. the webmail carver dosen't do much. good thing ftk has never let me down (ever.)
like the rest of you, i am waiting on ftk 2.0 - encase 6 looks better than it ever has but i question the new functions when the old ones still don't work properly.
Today I saw V6 from my colleagues
i am using encase 6 right now as we speak. the index function does not work, it crashes out. the webmail carver dosen't do much. good thing ftk has never let me down (ever.)
I've recieved the upgrade to V6, but I don't think I'll use it ? I'll wait for FTK V2.
There are several things i like about the new EnCase in principle, however having just tried to index a 3gb drive, which took 7hours. Its not practical for me to use yet (10 days for a 100gb drive at that rate 😯 )
Dual Xeon 2.8, 2GB ram, image stored on a local disk.
Hi to all, i am new to the forensics and i recently purchase Encase 6 for a case of mine.
I have read the forum and i gain much knowledge.
Although in my case i'm trying to figure out some things.
First. I took 5 hds to acquire. How can i ensure that no documents haven't been planted in, let's say if someone changes the bios clock and plants some documents.
I read here that event viewer would help, and indeed helps. But what if someone disables it ? TZLog.log keeps track in winXP but i didn't find it in win98 or 2000…
How can i be sure that a file attributes haven't been altered…
I want to strongen my report, and i ll be glad if you help me )
Thanx in advance.