I just realized Encase does not do Ubuntu Operating Systems.
Does FTK 2 work with Ubuntu?
Regards
FTK supports ext2fs and ext3fs. That means you can conduct examination on any flavour of linux assuming that you're using the normal ext fs.
I was under the impression that EnCase supported ext2fs/ext3fs also.
Are you perhaps expecting your tool to do more than that? You shouldn't be reliant on any forensic toolkit to parse all your OS artifacts for you because it just doesn't happen. Most of what you're after in Linux is in standard forms anyway and should be easy to read.
Just called Guidance software, they do not support ubuntu. Problem solved. FTK is the way forward then!
Regards
Encase does work with Ubuntu operating systems providing the Ubuntu system you are looking at has a supported filesystem within Encase.
Indeed the flavor of Linux system being looked at is irrelevant providing the filesystem is recognized.
Just to confirm, ext4 isn't supported therefore that is the reason why Ubuntu version doesn't work with encase. FTK 3 does support ext4 thought.
Regards