Extraction of Encas...
 
Notifications
Clear all

Extraction of Encase or Access data image  

  RSS
ajeet129
(@ajeet129)
New Member

Hi Everyone,

I am doing extraction on forensic images using Encase and FTK. I just wanted to check is there way i can filter the data on filecreate date, like i just want to extract files which are created for 1/1/2007.

Any help would be appreciated.

Thanks,
Ajeet Tiwari

Quote
Posted : 25/04/2014 11:02 pm
Encaser
(@encaser)
New Member

Hi
you can use encase conditions, or write new condition.
you must look encase menu(help)
if you can not write new condition, i can help you

ReplyQuote
Posted : 26/04/2014 12:46 am
Encaser
(@encaser)
New Member

However, dates can not be secure all times. you must look exif data after export. but all files have not exif data

ReplyQuote
Posted : 26/04/2014 12:54 am
ajeet129
(@ajeet129)
New Member

Thank you so much for response, if you can help me the sample code for creating condition it would be big help.

I have image and i want to include filecreated after 01/01/2007.

Thanks in advance.

Ajeet Tiwari

ReplyQuote
Posted : 26/04/2014 2:32 am
Encaser
(@encaser)
New Member

Hi, i'm wiriting new condition for you,
download this file

https://drive.google.com/file/d/0B0VFpVP3MqWkNlVuZzFuOUQ3Y1U/edit?usp=sharing

Encase contitions menu press right clik, import-> condition.txt
you are use now…

ReplyQuote
Posted : 28/04/2014 2:03 pm
ajeet129
(@ajeet129)
New Member

Thanks a lot, it was great help.

ReplyQuote
Posted : 28/04/2014 9:11 pm
Encaser
(@encaser)
New Member

not at all

ReplyQuote
Posted : 28/04/2014 11:23 pm
Share: