EnCase Imager verif...
 
Notifications
Clear all

EnCase Imager verification logs?

6 Posts
4 Users
0 Likes
1,628 Views
Adam10541
(@adam10541)
Posts: 550
Honorable Member
Topic starter
 

My googlefu has failed me, anyone know how/if EnCase imager creates verification logs?

 
Posted : 21/07/2016 8:43 am
jaclaz
(@jaclaz)
Posts: 5133
Illustrious Member
 

My googlefu has failed me, anyone know how/if EnCase imager creates verification logs?

You mean this?

Verifying Evidence Files
Verify Evidence Files checks CRC values of selected files. It is a way to ensure that evidence is not tampered with. Verified CRC information is written out to a log file. From the Evidence tab, you can check the CRC Errors tab in the bottom pane and bookmark any sectors that contain errors.

http//download.guidancesoftware.com/KU%2BE/U1Ix/edkrHovP20INeCqc5ribTB2vJxVDTiToVBaytASWq5Afg5YV/sHF1qdzL82L9O9Y%2Bu7j32H3J6pA%3D%3D

Or - maybe - this?
http//www.forensickb.com/2012/08/encase-enscript-to-verify-lef-colleciton.html

jaclaz

 
Posted : 21/07/2016 4:14 pm
Adam10541
(@adam10541)
Posts: 550
Honorable Member
Topic starter
 

Sorry my question was poorly worded.

I used to use EnCase V6 and from memory to get the verification log you had to manually save it after the verification process finished (opposed to Xways which automatically dumps it in the same location as the E01 files). I'm not sure what EnCase V7 does in this regard, however I used EnCase imager the other day and for the life of me can't find the logs or any way to save the log after the verification process finishes.

EnCase imager does go through the verification process but at the conclusion there is no message or any indication one way or another if the verification was successful or not.

My question should have been "Does EnCase imager create verification logs, and if so where/how can I find them?"

 
Posted : 26/07/2016 5:38 am
(@clownboy)
Posts: 46
Eminent Member
 

Add the image to EnCase Imager, the validation starts automatically. The result will be in the lower pane under the Report tab (scroll down.) You can print the report to pdf (right hand side below Lock / Unlock items is a small down arrow, select print.)

 
Posted : 26/07/2016 10:16 am
Adam10541
(@adam10541)
Posts: 550
Honorable Member
Topic starter
 

Thanks Clownboy, I am curious though as EnCase imager does verify the image immediately after it's taken will this information be in the same place then, or do you need to re-verify the image to have it visible?

 
Posted : 27/07/2016 6:07 am
jpickens
(@jpickens)
Posts: 130
Estimable Member
 

@Adam. You may want to log this as a defect or enhancement request on the GSI forums. https://support.guidancesoftware.com/forums

 
Posted : 27/07/2016 6:03 pm
Share: