23 Ağustos 2013 Cuma
Firmanın yapmış olduğu açıklamaya göre yeni sürümde bizleri bekleyen yenilikler şu şekilde;
(Şimdilik İngilizce olarak paylaşıyorum Türkçe'sini de yakın zamanda paylaşırım.)
Encase V 7.08 Demo 64 Bit
What’s New in Version 7.08
- Evidence Processor Manager
- Evidence Processor Enhancements
- Augmented File Carving for Images
- New Evidence Processor Lock/Unlock Flexibility
- Encryption Support Updates
- Windows Resilient File System (ReFS) Support
- Solaris Volume Manager Support
- Improved Hash Library Management
- Macintosh OS X Disk Image Support
- Safari Internet Artifact Updates
- Smartphone OS Application Support
- Usability Enhancements
- Create Tags Using Keyboard Shortcuts
- Create Logical Evidence Files from Search Results
- Improved Email Alternate Body Handling
The new Evidence Processor Manager allows for distribution and control of evidence processing for one or more EnCase Examiners or EnCase Processors.
With the Evidence Processor Manager, you can simplify evidence processing and acquisition by:
- Queuing evidence in the jobs list to be processed.
- Prioritizing the execution of evidence to be processed.
- Distributing the processing workload across multiple processing nodes. Any available node picks up the next job in the queue for the rapid processing of evidence.
File Carver
The File Carver augments existing file carving capabilities by using Windows Graphics Device Interface (GDI) libraries to accurately carve images according to their sizes and file types. GDI libraries identify the actual length of the file to be carved, resulting in increased probability of carving high fidelity images.
To review the new File Carving process, please see the Release Notes
New Evidence Processor Lock/Unlock Flexibility
Evidence Processor now gives you the following options so you can designate only the evidence that you want specifically processed:
- During initial processing, File Signature Analysis can be turned On or Off. The default is On.
- While running Evidence Processor with an existing evidence cache
- Keyword Search can be turned On or Off
- Recover Folders can be turned On if it was previously turned Off
EnCase Version 7.08 provides the following support for encryption products:
- Sophos SafeGuard Easy and Enterprise 6 (32-bit only)
- McAfee Endpoint Encryption 7.0 (32-bit only)
- Check Point Full Disk Encryption 8 (OS X and Windows)
EnCase supports the investigation of machines running the Windows 8 operating system. This includes the ability to acquire and parse allocated files and folders from the ReFS file system.
Solaris Volume Manager
EnCase now supports Solaris Volume Manager (SVM), to parse and investigate logical volumes on Solaris 9 and 10 computers.
Improved Hash Library Management
The Manage Hash Library function now allows you to:
- Select a hash set to work with
- View the contents of a hash set
- Delete individual items from a hash set
The following Macintosh OS X media types are now supported by EnCase:
- DMG format
- Sparse image format
- Sparse bundle format
EnCase now supports the following DMG formats:
- UDZO (zip compression algorithm)
- UDBZ (BZip2 compression algorithm)
- UDCO (Apple-proprietary ADC compression algorithm)
EnCase supports Safari Versions 5 and 6 including cookie and cache artifacts.
Smartphone OS Application Support
The following list shows software applications supported by EnCase, arranged by operating system.
Android
- Gmail
- Yahoo mail
- GTalk
- Google+
- Google Now
- Google Docs
- Dropbox
- Chrome Browser
- Google Maps
- Apple Maps
- Google Plus
Create Tags Using Keyboard Shortcuts
You can now create tags using keyboard shortcuts. Hot keys are assigned to the first ten tags (Alt-0 to Alt-9)
Search Results Exported to Logical Evidence Files
You can now export items in a set of search results to a logical evidence file (LEF). Search results may contain both entries and records. When you export search results containing only entries or containing only records, EnCase generates a single LEF. When you export search results containing both entries and records, EnCase generates two LEFs.
Improved Email Alternate Body Handling
When email systems append a plain text version of the email together with the HTML/rich text version, this text is called an "alternate body." Formerly, EnCase treated this as an attachment to the message, and displayed an attachment paper clip icon. Now, when an alternate body is the only attachment to an email message, EnCase displays a standard email icon, rather than the paperclip icon.
