CHFI v3 Module 14 Forensics Investigations Using Encase.pdf

(1366 KB) Pobierz
Computer Hacking
Forensics Investigator
Module XIV
Forensics Investigations
Using Encase
Module Objective
This module will familiarize you with the following:
•
•
•
•
•
•
•
•
•
•
•
•
EC-Council
Evidence files
Verifying file integrity
Hashing
Configuring EnCase
Searching
Bookmarks
Viewing recovered files
Master Boot Record
NTFS starting point
i
i
Hash values
Signature analysis
Email recovery
Copyright © by
EC-Council
All Rights reserved. Reproduction is strictly prohibited
Module Flow
Evidence File
Viewing recovered files
Verifying file integrity
Master Boot Record
Hashing
NTFS starting point
Configuring EnCase
Hash values
Searching
Signature analysis
Bookmarks
B k
k
Email recovery
reco er
Copyright © by
EC-Council
All Rights reserved. Reproduction is strictly prohibited
EC-Council
Evidence File
Evidence file is the core component in EnCase.
It consists of:
•
Header
•
Checksum
•
Data blocks
EC-Council
Copyright © by
EC-Council
All Rights reserved. Reproduction is strictly prohibited
Evidence File Format
Each evidence file is an exact, sector-by-sector
copy of a fl
f floppy or h d di k
hard disk.
Every byte of the file is verified using 32-bit
CRC,
CRC and it is virtually impossible to tamper
with the evidence once it has been acquired.
EnCase compresses large disks into a small size
size,
reducing up to 50% in size.
EC-Council
Copyright © by
EC-Council
All Rights reserved. Reproduction is strictly prohibited

Plik z chomika:

Inne pliki z tego folderu:

Inne foldery tego chomika:

Zgłoś jeśli naruszono regulamin