Hey everyone
Need some advice please. I used EnCase 6.5. I have run "Search for internet history" on a case. The results in Records show everything I needed, but the last access date and time for the same url, one from index.dat in the History.IE5 folder and one from index.dat in the History.IE5\MSHist01200…… folder, have a difference of 12 hours. Can anyone give me an explanation for this.
Thanks
Hi,
I don't use EnCase to analyse index.dat files, prefering to use Net Analysis as my main tool. It sounds like EnCase is not allowing for the weekly dat file, which will be in GMT, whereas being NZ I assume the daily and master dat files are GMT+12 hours (your local time).
Craig Wilson has written an article on this, it is available to download from
From the information you have provided it sounds like this is the most likely reason for your oddity.
Steve
Thanks Steve, I'll have a look.
I suggest posting on the encase boards to get an answer from someone at guidance.
Did you set your time zone when creating your case?