Encase - Carving files from unallocated space

Hi Jimmy

I only have Encase v5 but I believe what you're looking for is part of a script (sweep case) in v5. If you launch that script, you have to check the "find file" option and double click on it to tweak some basic settings …

Then, it's pretty self forward …

That option also exists in v.6. You can find it under the File Finder section in the Case Processor EnScript.

Does anyone know how to add custom files to the file finder feature in case processor? It asks for the headers and footers, but i've been unable to find reliable information on them for .wmv files.

Thanks.

Try having a look at 'Foremost' on the Helix disc. You will find some helpful information about file headers in the config file for the application and you should be able to use these in the EnCase custom file header option.

Does anyone know how to add custom files to the file finder feature in case processor? It asks for the headers and footers, but i've been unable to find reliable information on them for .wmv files.

Thanks.

Hi Biddly,

Click on "Import from File Signatures Table" then in the list there is a Multimedia category. In there is a "Windows Media (ASF compression)" which should cover wmv files.

Hope that helps!

That option also exists in v.6. You can find it under the File Finder section in the Case Processor EnScript.

I didn't want to start a whole new topic, but wanted to say this was helpful…I've just started playing with EnCase V6.18, and have been trying to figure out where to find my Sweep Case functionality.

Is Case Processor a full replacement for Sweep Case, or does it just include the file finder utility?

Thanks!

–SFGAirborne

If you are after a more fully featured carver, I wrote and uploaded this

https://support.guidancesoftware.com/forum/downloads.php?do=file&id=1158

It will carve based on header and fixed length, or embedded length or footer etc. and is configurable for things like PDFs, basic JPEG, Office etc

EnCase 6 only.

Regards,
James