±Forensic Focus Partners

Become an advertising partner

±Your Account


Username
Password

Forgotten password/username?

Site Members:

New Today: 0 Overall: 36763
New Yesterday: 2 Visitors: 177

±Follow Forensic Focus

Forensic Focus Facebook PageForensic Focus on TwitterForensic Focus LinkedIn GroupForensic Focus YouTube Channel

RSS feeds: News Forums Articles

±Latest Articles

±Latest Videos

±Latest Jobs

EnCase: Mount password protected zip file

Forensic software discussion (commercial and open source/freeware). Strictly no advertising.
Reply to topicReply to topic Printer Friendly Page
Forum FAQSearchView unanswered posts
Page 1, 2  Next 
  

ckwongkennyw
Newbie
 

EnCase: Mount password protected zip file

Post Posted: Oct 03, 19 09:58

I have a zip file with password protection in my evidence file. But every time I type in different password, I can mount the file with View File Structure even though the password is wrong. Did anyone encounter this too? What can I do to stop this from happening? As I want to check if I have applied a correct password or not. Thank you.  
 
  

Rich2005
Senior Member
 

Re: EnCase: Mount password protected zip file

Post Posted: Oct 03, 19 10:21

Is the problem perhaps that you've got an archive where the filenames aren't encrypted, so EnCase can "open" it, regardless of the password?
Can you view the content of the files, and not just their names, (in a readable form) with the wrong password?  
 
  

ckwongkennyw
Newbie
 

Re: EnCase: Mount password protected zip file

Post Posted: Oct 03, 19 10:31

I can’t view the content of the file even though I can export it after mounting the file.  
 
  

Rich2005
Senior Member
 

Re: EnCase: Mount password protected zip file

Post Posted: Oct 03, 19 13:42

So it sounds like what I described (if I'm understanding you correctly). I.e. you've got an archive where the filenames aren't encrypted, so you can view the content listing, but not extract the contents of them properly without the correct password.  
 
  

ckwongkennyw
Newbie
 

Re: EnCase: Mount password protected zip file

Post Posted: Oct 03, 19 14:17

Yes. I can view the content listing, and I can even export the file but I cannot view the content. I am trying to develop an EnScript so that I can apply different password from a list to the zip file but I am not sure whether it can be done with EnScript


Code:
	void checkCredential(EntryClass e, String password){
 		EntryFileClass file = new EntryFileClass();
		CredentialClass cred();
		cred.SetPassword(password);
    
		if (file.Open(e, 0, cred)) {
			switch (cred.ErrorType()) {
			  case CredentialClass::NONE:
				Console.WriteLine("File can be decrypted {0}, password: {1}", file.Name(), password);// no errors
				break;
			  case CredentialClass::BAD_EVIDENCE_FILE_PASSWORD:
				Console.WriteLine("Unable to decrypt file Bad Evidence File Password {0} , password: {1}", file.Name() , password);
				break;
			  case CredentialClass::BAD_PASSWORD:
				Console.WriteLine("Unable to decrypt file Bad password {0} , password: {1}", file.Name() , password);
				break;
			  case CredentialClass::BAD_CREDENTIALS:
				Console.WriteLine("Unable to decrypt file Bad Credentials {0}, password: {1}", file.Name(), password);
				break;
			  case CredentialClass::BAD_NEED_MORE_INFO:
				Console.WriteLine("Unable to decrypt file No Credentials {0}, password: {1}", file.Name(), password);
				break;
			}

		
		}
 
 
  

Rich2005
Senior Member
 

Re: EnCase: Mount password protected zip file

Post Posted: Oct 03, 19 15:22

Ah. I'm no EnScript expert, and it's been quite a while since I've used EnCase regularly, but I would have thought this is the sort of thing Simon Key would be able to tell you. He was the EnScript wizard from what I remember and would likely know if this is possible (or if something's already been created to do what you want - or similar code). A quick Google shows he's still at Guidance (now OpenText). Might be worth trying to contact him for a quick question to save you some time.  
 
  

jaclaz
Senior Member
 

Re: EnCase: Mount password protected zip file

Post Posted: Oct 03, 19 16:28

Excuse me, as I do not know what a "normal" Encase workflow is, nor what is your specific workflow/procedure, but wouldn't it be easier to extract the archive from the Encase evidence file, process it "normally" (with a batch/bash script or any "try passwords from list program"), and once you have found which among the candidates is the correct password use it inside Encase?

jaclaz
_________________
- In theory there is no difference between theory and practice, but in practice there is. - 
 

Page 1 of 2
Page 1, 2  Next