I know the file format EnCase uses for its image files is documented, but is there any way to obtain some sample files which doesn't involve forking out for an expensive product I'll never use?
If I understand your question you dont need to purchase anything. EnCase will operate in acquisition mode without the hardware dongle, this will allow you to create image files of hard drives but you will not be able to preview the image.
Well, the problem is to download the software in the first place, I need to provide a serial number of a security key along with an email address, and it doesn't look like I can get a security key without paying.
Download the FTK imager from AccessData. It's free, no login required to download it, and it will produce images in raw (dd), Encase, or smart format.
That should enable you to make any sample image you want.
Matt
Hi,
Order the free Encase demo CD via their web - it comes with sample Image files you can use with the demo.
Hi,
If you purchase the book "Guide to Computer Forensics and Investigations, 2nd Ed by Nelson, Phillips, Enfinger & Stewart Thomson Course Technology (2006) it comes with two CD's and a DVD. The DVD has a demo version of Encase 4, two PC Encase format images, a server Encase image and a RAID Encase image. The images work with the demo software.
The two CD's also have some Encase format images, but these don't work in the demo software.
The book is also a great reference and well worth the purchase on its own.
Regards,
Ian Parks
Australia
do you find any significant differences between encase4 and encase 5 ?
is encase5 a must ?
does 4 do the same job?
are the differences of a cosmetic nature?
The encase4's Key can be used on encase5?
Someone said it is OK,but I have no success.
You can´t use the V4 dongle to open V5 , but with V5 dongle you can open a V4 without problem.
do you find any significant differences between encase4 and encase 5 ?
is encase5 a must ?
does 4 do the same job?
are the differences of a cosmetic nature?
read this pdf
http//
–
Fabio Portes.