Extraction of Encase or Access data image
I am doing extraction on forensic images using Encase and FTK. I just wanted to check is there way i can filter the data on filecreate date, like i just want to extract files which are created for 1/1/2007.
Any help would be appreciated.
you can use encase conditions, or write new condition.
you must look encase menu(help)
if you can not write new condition, i can help you
However, dates can not be secure all times. you must look exif data after export. but all files have not exif data
Thank you so much for response, if you can help me the sample code for creating condition it would be big help.
I have image and i want to include filecreated after 01/01/2007.
Thanks in advance.
Hi, i'm wiriting new condition for you,
download this file
Encase contitions menu press right clik, import-> condition.txt
you are use now…
Thanks a lot, it was great help.
not at all