Extraction of Encas...
 
Notifications
Clear all

Extraction of Encase or Access data image

7 Posts
2 Users
0 Reactions
2,302 Views
(@ajeet129)
Active Member
Joined: 13 years ago
Posts: 16
Topic starter   [#11710]

Hi Everyone,

I am doing extraction on forensic images using Encase and FTK. I just wanted to check is there way i can filter the data on filecreate date, like i just want to extract files which are created for 1/1/2007.

Any help would be appreciated.

Thanks,
Ajeet Tiwari



   
Quote
(@encaser)
Active Member
Joined: 13 years ago
Posts: 14
 

Hi
you can use encase conditions, or write new condition.
you must look encase menu(help)
if you can not write new condition, i can help you



   
ReplyQuote
(@encaser)
Active Member
Joined: 13 years ago
Posts: 14
 

However, dates can not be secure all times. you must look exif data after export. but all files have not exif data



   
ReplyQuote
(@ajeet129)
Active Member
Joined: 13 years ago
Posts: 16
Topic starter  

Thank you so much for response, if you can help me the sample code for creating condition it would be big help.

I have image and i want to include filecreated after 01/01/2007.

Thanks in advance.

Ajeet Tiwari



   
ReplyQuote
(@encaser)
Active Member
Joined: 13 years ago
Posts: 14
 

Hi, i'm wiriting new condition for you,
download this file

https://drive.google.com/file/d/0B0VFpVP3MqWkNlVuZzFuOUQ3Y1U/edit?usp=sharing

Encase contitions menu press right clik, import-> condition.txt
you are use now…



   
ReplyQuote
(@ajeet129)
Active Member
Joined: 13 years ago
Posts: 16
Topic starter  

Thanks a lot, it was great help.



   
ReplyQuote
(@encaser)
Active Member
Joined: 13 years ago
Posts: 14
 

not at all



   
ReplyQuote
Share: