?To EnCase Forensic version 8 users, I'm converting from version 6. Can version 8 handle *.docx, *.xlsx files without having to save the older file type to do a valid scan, like I had to do with version 6? I do multiple scans every day, using up to 1,000 words or phrases from my master word list, analyzing up to 800.000 hits per scan, which is the main reason for using EnCase. The user manual doesn't help answer this, and Guidance Sofware Tech Support phones always seem to be busy.
In versions 8 (and 7) if you index the evidence using the evidence processor, you will then be able to perform an index search for keywords/phrases in Office 2007 -> file types (docx, xlsx etc).
You can also index a Result Set (or a logical evidence file) where your result set (or LEF) contains just the file types of interest.
hommy0 - Thank you for your reply post. That really helps. Moving from 6 to 8 is a real pain, but since 6 and 7 aren't supported anymore, I'm having to work with a steep learning curve. Thanks.
If your having to change to Encase 8, change to X-Ways and you'll never look back )
hommy0 - Thank you for your reply post. That really helps. Moving from 6 to 8 is a real pain, but since 6 and 7 aren't supported anymore, I'm having to work with a steep learning curve. Thanks.
version 7 is still supported, however you need to make sure your maintenance has not expired for your dongle/e-license.
If your having to change to Encase 8, change to X-Ways and you'll never look back )
Heh, unless you've got encrypted drives then check your rear-view mirror.