EnCase 7 Anti-Forensic for Air-Gapped Examiner

A bit of tool validation Does the tool allow binaries to 'escape'? Can a mistake on the part of the analyst make that happen? If it happens, can it be traced? Deciding that it does, and under what circumstances is almost certainly a validation issue.

This is actually demonstrated and described in a preceding and a follow-up post. Binaries can 'escape' from EnCase 7 in multiple ways.

Rum raisin. Suggested by Monsieur Emy in 1768; one of the few ice creams that has any libation and still makes proper ice cream! mrgreen