Notifications

Clear all

Guideline for EnCase workflow

kovar · 2009-11-30T20:38:10Z

Good morning,I was asked to come up with a guideline for a normal EnCase work flow. This isn't a "do this every single time" list, more of a "here are some things you should think about doing and the order to do them in." Comments on this would be welcome. 1. Create case - Ensure that you have all relevant information - custodians, clients, case name, etc. 2. Add evidence - E01, LEFs, loose files, etc. 3. Confirm disk geometry, sector count, partitions. 4. Run Partition Finder if indicated 5. Run Recover Deleted Folders 6. Search case - hash and signature analysis 7. Run File Mounter - recursive, not persistent, create LEF, add LEF to case 8. Run Case Processor -> File Finder. Export results, add back in as LEF. 9. Search case - hash and signature analysis 10. Search for encrypted or protected files. Address as appropriate. 11. Extract registry hives 12. Index case.Other tasks outside of EnCase 1. Mount image and scan for viruses 2. Mount image and run triage tool(s) against it 3. Run image in LiveView or VFC to see system as user experienced it 4. Run Run RegRipper and RPRipper against registry hives

Page 5 / 5 Prev

General (Technical, Procedural, Software, Hardware etc.)

Last Post by kovar 15 years ago

44 Posts

13 Users

0 Reactions

5,486 Views

RSS

jhup

(@jhup)

Noble Member

Joined: 16 years ago

Posts: 1442

09/02/2010 1:58 am

I have not given up on this, despite the stagnation for … 4 years now?

Anyone interested on fleshing this out further?

ReplyQuote

kovar

(@kovar)

Prominent Member

Joined: 18 years ago

Posts: 805

Topic starter 09/02/2010 10:27 pm

Greetings,

I've lost track - what does "this" refer to? I'm probably willing to help. I'm probably unable to take the lead on anything at the moment.

-David

ReplyQuote

jhup

(@jhup)

Noble Member

Joined: 16 years ago

Posts: 1442

10/02/2010 10:53 am

I have no idea.

. . .

Oh! Yes, Digital Forensics Workflow Guideline also knowns as DiFoWoGu.

ReplyQuote

kovar

(@kovar)

Prominent Member

Joined: 18 years ago

Posts: 805

Topic starter 10/02/2010 8:09 pm

Oh! I'm in. I already wrote a version for EnCase, your turn!

Ok, ok, that's not *really* funny.

-David

ReplyQuote

Page 5 / 5 Prev

8 Forums
15.7 K Topics
92.3 K Posts
233 Online
41.1 K Members

Forum Icons: Forum contains no unread posts Forum contains unread posts

Topic Icons: Not Replied Replied Active Hot Sticky Unapproved Solved Private Closed