ENCASE: Examiner Log

There isn't a log like you're describing as such. Someone wouldn't be 'receiving md5 errors'. They'd either have verified it and received an md5 error at the start. Or not verified it at all. Or verified it, received no md5 error, then verified at a later date and got an md5 error, due to corruption of the data somehow perhaps.

Rich thank you very much for the response and i do appreciate it.

I think the problem that was verbally stated is there is a md5 verification mismatch. Does that change anything in your response?

ForensicBuddy

Is this the same issue as the one you posted here
http//www.forensicfocus.com/index.php?name=Forums&file=viewtopic&t=4118

or is this a different one? Just curious….

-=ART=-

Does encase have a log that shows each job a person has worked on and whether or not they were receiving errors?

So if someone was working on a case and was receiving MD5 verification errors and then all of a sudden the errors were gone? I would like to see the log file in encase showing where it generated these errors. Does anyone know where this log can be found?

Greatly appreciated,
FORENSICBUDDY- ANDREW

EnCase Enterprise has logs that show when a user logged onto the system (SAFE) and what they attached to etc… but nothing that I am aware of describing what you are saying. As far as MD5 is concerned you can look at the verification hash after a file integrity check.

Are you talking about the image acquisition MD5 or individual file MD5s? Is Encase acquiring a physical device or adding evidence from an image file?

Was a write blocker employed? Does it detect the HPA and DCO?

More information is needed to understand what is being asked.