Extraction of Encas...
 
Notifications
Clear all

Extraction of Encase or Access data image

7 Posts
2 Users
0 Reactions
1,794 Views
(@ajeet129)
Active Member
Joined: 12 years ago
Posts: 16
Topic starter  

Hi Everyone,

I am doing extraction on forensic images using Encase and FTK. I just wanted to check is there way i can filter the data on filecreate date, like i just want to extract files which are created for 1/1/2007.

Any help would be appreciated.

Thanks,
Ajeet Tiwari


   
Quote
(@encaser)
Active Member
Joined: 12 years ago
Posts: 14
 

Hi
you can use encase conditions, or write new condition.
you must look encase menu(help)
if you can not write new condition, i can help you


   
ReplyQuote
(@encaser)
Active Member
Joined: 12 years ago
Posts: 14
 

However, dates can not be secure all times. you must look exif data after export. but all files have not exif data


   
ReplyQuote
(@ajeet129)
Active Member
Joined: 12 years ago
Posts: 16
Topic starter  

Thank you so much for response, if you can help me the sample code for creating condition it would be big help.

I have image and i want to include filecreated after 01/01/2007.

Thanks in advance.

Ajeet Tiwari


   
ReplyQuote
(@encaser)
Active Member
Joined: 12 years ago
Posts: 14
 

Hi, i'm wiriting new condition for you,
download this file

https://drive.google.com/file/d/0B0VFpVP3MqWkNlVuZzFuOUQ3Y1U/edit?usp=sharing

Encase contitions menu press right clik, import-> condition.txt
you are use now…


   
ReplyQuote
(@ajeet129)
Active Member
Joined: 12 years ago
Posts: 16
Topic starter  

Thanks a lot, it was great help.


   
ReplyQuote
(@encaser)
Active Member
Joined: 12 years ago
Posts: 14
 

not at all


   
ReplyQuote
Share: