Folks,
Working on spec'in out a new machine, and looking to buy Encase. We're looking at a Vista 64 bit build..anyone run this build, and does the modules (such as Physical Disk Emulator) work under 64 bit Vista? If it doesn't, what do you use to mount forensic image files for virus scans, etc?
Thanks!
Chris
You are asking here because the misguidence site is hostile to finding this data? Sales not answering?
I called sales a couple days after posting here. It took them a while to respond. They were quick to point out that Encase V6 does indeed work with Vista. However, they stated the modules did not work with Vista, and were currently being worked on. They went on to tell me that most investigators still use XP Pro.
My contention is this..if I've got a 64 bit processor with 8 GB of RAM, why would I want to buy a 32 bit OS? As it's quickly approaching the time to purchase a new machine and software, I was doing some "wish-listing". I didn't make sense to me to have purchased their "Cadillac" offering of software + modules + 3 year license, when they have no target date of when the modules will work on Vista 64 (I'm having trouble finding XP 64). Also in consideration was the fact that the only module I really needed was the Physical Disk Emulator.
Of course, how is the PDE different than say Mount Image Pro?
Chris
This is from the Encase help file.
New Features in Version 6.6
64-bit VFS Support
EnCase now supports the Virtual File System module on 64-bit platforms.
64-bit PDE Support
EnCase now supports the Physical Disk Emulator module on 64-bit platforms.
From what sales told me, I think the problem lies with Vista 64 bit. Not sure, but I would have thought they'd gotten it fixed by now.
Just as an aside, how many examiners are using 64 bit Windows XP?
Chris
I'm using X64 of XP, 2003, Vista and 2008 and it works OK under all platforms.
That said I have just been informed that there is a bug which is resolved in 6.11.3 but this won't affect your problem.
The biggest problem I've had is that they did not sign their drivers so without disabling the driver signing requirement it won't work.
Personally if I want to mount an image I use Mount Image Pro.