Create an account Home  ·  Topics  ·  Downloads  ·  Your Account  ·  Submit News  ·  Top 10  
Modules
· Home
· Content
· FAQ
· Forensic Downloads
· Forensics Feedback
· Forums
· Recommend Us
· Statistics
· Surveys
· Top 10
· Topics
· Training Reviews
· Web Links
· Your Account

Our Membership

Latest: binojkoshy1
New Today: 2
New Yesterday: 4
Overall: 27452

Computer Forensics
This is a free and open peer to peer medium for digital and computer forensics professionals and students. Please help us maintain it by contributing and perhaps linking to us from your own website.

Recent Posts

 What do I do Next?
 What does your job involve?
 Forensic scripts and tasks
 Windows Registry Default Printer
 Strange startup traffic

Computer Forensics World Forums


Pages Served
We received
34749448
page views since August 2004

Security Sources

Firewalls
Cryptography
ISO 17799 ISO 27001
ISO 17799 Toolkit
ISO 27001 & 27000
Disk Analysis
Security Policies

Computer Forensics World: Forums

Computer Forensics World :: View topic - Has anybody got encase 4.2 ?
 Forum FAQForum FAQ   SearchSearch   UsergroupsUsergroups   ProfileProfile   Log in to check your private messagesLog in to check your private messages   Log inLog in 

Has anybody got encase 4.2 ?
Goto page 1, 2  Next
 
Post new topic   Reply to topic    Computer Forensics World Forum Index -> Forensic Software and Tools
View previous topic :: View next topic  
Author Message
perlish
Newbie
Newbie


Joined: Nov 22, 2004
Posts: 1

PostPosted: Mon Nov 22, 2004 6:55 pm    Post subject: Has anybody got encase 4.2 ? Reply with quote

I can only get the encase 3.22 ,anybody could be kind enough to upload a 4.2 version,thx in advanced
Back to top
View user's profile
gralfus
Newbie
Newbie


Joined: Sep 30, 2004
Posts: 113

PostPosted: Fri Dec 03, 2004 9:09 am    Post subject: Reply with quote

Have you tried the vendor?
guidancesoftware.com/products/EnCaseForensic/index.shtm
Back to top
View user's profile
RobTabor
Newbie
Newbie


Joined: Jan 30, 2005
Posts: 4

PostPosted: Mon Jan 31, 2005 9:31 am    Post subject: Re: Has anybody got encase 4.2 ? Reply with quote

perlish wrote:
I can only get the encase 3.22 ,anybody could be kind enough to upload a 4.2 version,thx in advanced


I have a feeling you are wanting a free/hacked copy, that's a no no in this business...

Also, there are NO cracks for anything above 3.22 anyway.

Rob
Back to top
View user's profile
ForensicsAuditor
Guest





PostPosted: Wed Mar 16, 2005 8:24 am    Post subject: Buy your own Reply with quote

Using hacked forensics software is like being a cop and robbing banks. Leaves a bad taste in my mouth. Evil or Very Mad

If you want free stuff, there are things out there you can use.

If you want Encase, you really will only find it on the vendor website AND then you will need the USB key that carries the license (encrypted).

Dont think you can use a hack on 4.2, they are already issuing new USBs for the key hacked last year (which hack, by the way, has been removed from the internet so dont go looking for it unless you want a virus or trolan from a hacker site luring you there on promises for the software or a license hack).

If you have a license go to the vendor site, otherwise you will need to buy one. Laughing
Back to top
Sco
Newbie
Newbie


Joined: Mar 22, 2005
Posts: 4

PostPosted: Wed Mar 23, 2005 9:42 am    Post subject: Reply with quote

Just out of interest how much is encase (the newest version?) I heard that it was over a grand. Quite a packet, but thats because its suppost to be used by Government agencies, law enforcement and large corporate businesses.

As mentioned above, you would do very well to get a crack copy, your probably better looking for some free software that is good.

Sco
Back to top
View user's profile
nitinchfi
Newbie
Newbie


Joined: Nov 13, 2005
Posts: 41
Location: INDIA

PostPosted: Mon Nov 14, 2005 3:09 pm    Post subject: ****ENCASE**** Reply with quote

Hi,

1> Before using ENCASE.

2> answer the following

3>R u Loyal to the Community 2 u belong or trying to join

4> I mean FORENSICS.

5> U should first understand the "ETHICS".

6> Its Illegal to use Cracked /Pirated S/W. & also the one who helps is also a criminal.

So please respect the IT CYBER-FORENSICS
_________________
Nitin Kushwaha
CHFI.CEH.SCSCA.CIW-SA.MCSE.MCSA.MCP.ITIL
Back to top
View user's profile
andocrates
Newbie
Newbie


Joined: Dec 25, 2005
Posts: 31

PostPosted: Tue Jan 10, 2006 11:10 am    Post subject: . Reply with quote

Yea, ditto. Besides encase isn't that great - it just has a track record in the courts. I find AccessData is much easier to use. (still expensive)
Back to top
View user's profile
kattom
Newbie
Newbie


Joined: Feb 03, 2007
Posts: 5

PostPosted: Sat Feb 03, 2007 10:26 pm    Post subject: Reply with quote

Don't be so .. in some europenian courts cracked EnCase v4 was used too Wink
Back to top
View user's profile
kattom
Newbie
Newbie


Joined: Feb 03, 2007
Posts: 5

PostPosted: Sat Feb 03, 2007 10:31 pm    Post subject: Reply with quote

Sco wrote:
Just out of interest how much is encase (the newest version?) I heard that it was over a grand. Quite a packet, but thats because its suppost to be used by Government agencies, law enforcement and large corporate businesses.

As mentioned above, you would do very well to get a crack copy, your probably better looking for some free software that is good.

Sco



Correct, there are 3 versions of EnCase, now v6:

EnCase Enterprise - network forensic tool with eDiscovery and Automated Incident Response Suite modules

Field Intelligence model - network enabled forensic tool for law enforcement

and EnCase Forensic.
Back to top
View user's profile
Prickaerts
Newbie
Newbie


Joined: Jan 03, 2006
Posts: 255
Location: The Netherlands

PostPosted: Mon Feb 05, 2007 5:42 pm    Post subject: Reply with quote

To tie up this post Smile

The cost of Encase forensic edition can run up to 4500, but then you are automatically entitled to receive new version of the product as they come available. And you also have PDE, which allows you to mount Encase images as a volume.

Regarding cracked version. In court I would have shredded the evidence, because if it was cracked, how can you verify the integrity of the program? ---> results that come from using the program.

And true it might work similar to a licensed version, but what does this tell the court about your ethics?

You earn money doing forensics? Buy software or use open source tools.
Back to top
View user's profile Send e-mail Visit poster's website
rmriinc
Newbie
Newbie


Joined: Feb 13, 2007
Posts: 2
Location: Columbia, MO.

PostPosted: Tue Feb 13, 2007 5:46 pm    Post subject: EnCase Reply with quote

I have read this topic several times, and I feel compelled to respond...

First of all, EnCase 4.2 has in fact been "cracked". Part of what I do is research software vulnerabilities; for the defense in my particular case. One should be able to show in court that they have a copy of EnCase that they purchased, or the agency that they work for has purchased. I actually have no problem with a person having a "cracked" copy of EnCase, as long as they do not use it to make money with or assist the prosecution with in court. What one could do (AND I AM NOT ADVOCATING THIS), but for the purpose giving a less nefarious scenario; one could use a "cracked" copy of EnCase to compare the results that they might get from running an open source forensic analysis on a program such as Autopsy. But understand that the ethics of this are derived from the fact that when you use "cracked" software, you are taking money from the manufacturer, and thereby potentially raising the price of said software for everyone else that needs it to work with.

Let me pose a few questions about Guidance Software. Is it not an indication of how computer savvy a company is when their servers are hacked and several thousand people have their credit card details stolen as a result of this? If you can't secure your servers and protect your customers, is your software really going to be all that good?

There is better forensic software out there. As a matter of fact there is software out there that is far more "straightforward" than EnCase.

EnCase is a court accepted program for doing a forensic analysis of a hard drive, but that does not make it a good piece of software, the fact of the matter is that is guidance Software's primary claim to fame. Notably the courts are behind on such methods of hi-tec investigation. Just as sure as the courts still believe and accept the MD5 Checksum as a valid source for authenticating digital evidence, when in fact the MD5 Checksum can be manipulated with a collision attack in approximately 45 minutes at this time. In the near future we will see the courts in the USA rule digital evidence authenticated with the MD5 Checksum alone as inadmissible. It has already happened once in Australia.

I personally don't want to make a new poster feel uncomfortable for asking a question here. We have no way of judging the "innocence" of the question. I would much rather try to inform and educate the poster as best I can.

Thank you all for your time.

Have a nice day.



Rick.
_________________
Risk Management Research & Investments, Inc.
"He Who Forgets, Will Be Destined To Remember"

MAIL BOX: 2101 W. Broadway PMB 326, Columbia, MO. 65203
OFFICE ADDRESS: 607 N. Providence, Columbia, MO. 65203

Phone: (888) 571-0958
Back to top
View user's profile Send e-mail Visit poster's website AIM Address Yahoo Messenger MSN Messenger
hdollar
Newbie
Newbie


Joined: Feb 22, 2007
Posts: 25
Location: Gettysburg, Pa USA

PostPosted: Wed Feb 28, 2007 2:22 am    Post subject: encase Reply with quote

I think the better question for this forum would be does anyone have an older version of encase that they are willing to sell?

Because I agree, it you are in a court of law your ethics and practices are now in question because you are using an illegal copy of the program.
_________________
Hdollar@comcast.net
Back to top
View user's profile MSN Messenger
nitinchfi
Newbie
Newbie


Joined: Nov 13, 2005
Posts: 41
Location: INDIA

PostPosted: Sat Apr 28, 2007 10:28 pm    Post subject: Encase Reply with quote

Hi All,

I think the best option would be to use a Open Source Software for performing Live forensics as well as offline/dead forensics.

Sleuthkit+Fire is always the best option.

Also there are many but infact "dd" has been approved as forensicall sound to be presented in any court for evidence, with a proper documented steps with your Incident Handlers diary.

FTK is good in UI but lacks some of the features in which Encase can do really well.

X-ways Forensics is my favourtie since It gives you a lot of options.

So It depends the case you are handling and the sensitivity of the case.

and not the software,

So if u are handling a case which is more important, I would recommend spend some bucks and get Encase.

If you are doing an assignment for a mid-size company an Open-source solution would do well.

Thanks.
_________________
Nitin Kushwaha
CHFI.CEH.SCSCA.CIW-SA.MCSE.MCSA.MCP.ITIL
Back to top
View user's profile
cfprof
Newbie
Newbie


Joined: Apr 15, 2006
Posts: 36
Location: Pennsylvania

PostPosted: Sat Apr 28, 2007 10:55 pm    Post subject: FTK/Encase Reply with quote

Nitinchfi wrote:

"FTK is good in UI but lacks some of the features in which Encase can do really well."


I'm curious....what features are those.......?
Back to top
View user's profile
nitinchfi
Newbie
Newbie


Joined: Nov 13, 2005
Posts: 41
Location: INDIA

PostPosted: Sun Apr 29, 2007 3:36 am    Post subject: Reply with quote

HI cfprof,

No conflicts on Encase vs FTK,

It's just my experience and my personal taste.

so well, regarding FTK I agree on its superior Index,
weel, on Encase, Encase allows third party scripts, so that you could write your own complex search strings, or perhaps download someone else's. The script functions are really quite good, and this feature allows for limitless functionality.

FTK currently cannot reconcile the Macintosh file system. Encase can interpret that plus some Unix file systems.
FTK's cannot acquire RAID's. Encase provides multiple options for dealing with RAID's.

I am not sure if FTK has got it in its latest versions.

also with FTK you need to buy the Ultimate toolkit seperately + additional cost.

So cfprof thats my view on FTK and Encase,

you can go ahead and use FTK if u like and are comfortable or you can give a try with Encase.

Also there are S.M.A.R.T and H.E.L.I.X which works off the cdrom and supports network based imaging for conducting Live analysis too.

Thanks
_________________
Nitin Kushwaha
CHFI.CEH.SCSCA.CIW-SA.MCSE.MCSA.MCP.ITIL
Back to top
View user's profile
Display posts from previous:   
Post new topic   Reply to topic    Computer Forensics World Forum Index -> Forensic Software and Tools All times are GMT + 10 Hours
Goto page 1, 2  Next
Page 1 of 2

 
Jump to:  
You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot vote in polls in this forum

Powered by phpBB 2.0.10 © 2001 phpBB Group
phpBB port v2.1 based on Tom Nitzschner's phpbb2.0.6 upgraded to phpBB 2.0.4 standalone was developed and tested by:
ArtificialIntel, ChatServ, mikem,
sixonetonoffun and Paul Laudanski (aka Zhen-Xjell).

Version 2.1 by Nuke Cops 2003 http://www.nukecops.com

Forums ©

 

TMs property of their respective owner. Comments property of posters. 2007 Computer Forensics Science World.
Digital forensic computing news syndication: Computer Forensics Training News or UM Text
Software is copyrighted phpnuke.org (c)2003, and is free under licence agreement. All Rights Are Reserved.