How To Use Encase On A Computer Or A Hard Drive (For A Computer)

Transcription

1 EnCase Version Release Notes October 3, 2014 EnCase Version Thank you for using Guidance Software products. The Release Notes for this version of EnCase contain important information regarding your EnCase application. Before you install, we recommend that you read the Release Notes to better understand the changes we have made. SAFE Version The SAFE version for this release is 7j7. Servlets were rebuilt. is provided for informational purposes only.

2 New Features OS X Servlet Support EnCase now provides servlet support for Macintosh OS X Enhanced SQLite Support EnCase now supports SQLite version Linux Logical Volume Manager (LVM) Symmetric and Asymmetric Support EnCase now provides LVM symmetric and asymmetric support for Linux RAID 5 disks. Items Fixed CORE-1585: In the Search tab, if one or more entries is selected and acquired to a LEF, subsequent entries are now added to the existing LEF successfully. CORE-1482: Clicking an index hit line number in the Review tab did not go to the specific hit in the Transcript tab. This is fixed. CORE-1429: The True Path column in Records view did not display correct path information for thumbnails and Internet artifacts. This is fixed. CORE-1427/69221: EntryClass should provide an accurate Linux path for logical drives. There is a new function on EntryClass called GetMachinePath that returns the best guess for the OS dependent location of the entry. CORE-1380: In Entries view, the true path of any entry displayed two backslashes after the case file name. This is fixed. CORE-1376: Connection to HPUX dropped after adding and mounting devices and performing Scan LVM. This is fixed. CORE-1374: Disk view displayed non-primary FAT sectors as primary FAT. This is fixed. CORE-1373: Auto Extents did not display correctly in Disk view for files on an exfat formatted drive. This is fixed. CORE-1370/69762: Parsing MFT over a SAFE network preview took an excessive amount of time. This is fixed. CORE-1369: The process of updating reports while running Analysis Browser caused EnCase to hang. The upgrade to SQLite fixes this. 2

3 CORE-1102/69865: A FileVault 2 volume was not parsing over a SAFE network, and it was not possible to view the decrypted core storage file structure. This is fixed. SR : A case had a folder with only one file with a logical size of zero, but CredDB.CEF showed it as encrypted. This is fixed. Known Limitations Found in Version 7.10 CORE-1527: The 32 and 64-bit EnCase servlet requires the Windows Management Interface (WMI) service for installation and operation on Windows 8, Windows 8.1, Windows Server 2012, and Windows 2012 R2. TS-141: File Carver may display a status of 100 percent complete, but continue to process or crash EnCase. This situation is caused by File Carver searching for numerous file types, including headers leading with "..." Guidance Software recommends that you perform file carving for file types with "..." leading headers separately. CORE-1322: When exporting items in Search Results, if Add to existing evidence file is selected, EnCase will crash. CORE-895/69792: The index uses all caps by default; so, for example, DOBBS is the only possible hit for a search on <c>dobbs. <c>dobbs, <c>dobbs, and all other case variations are in a different set. Found in Version : After several iterations of running Case Analyzer and bookmarking, when clicking on a bookmark created with Case Analyzer, EnCase may crash. Found in Version : Outside In: EnCase hangs while viewing some.mif files. Found in Version : EnCase becomes unstable when you drag and drop evidence into a case while a sort operation is running. Guidance Software Product Compatibility Tables The Support Portal contains a list of version-to-version compatibility tables for all Guidance Software products at 3

4 Target Machine Operating Systems Servlets are deployed on target machines and can be used to search the following operating systems: AIX 4.3, 5.1, 5.2, 5.3, 6.1, 7.1 HPUX 11.0, 11.1x, 11.2x Linux Kernels (32 and 64-bit) or (32-bit) or higher with Process File System (procfs) NetWare 5.1 SP8, 6.0 SP4, 6.5 Mac OS X 10.2 through (32 and 64-bit, Intel, and PPC) Solaris 8, 9, 10 (32 and 64-bit, SPARC only) Windows XP (32 and 64-bit) Windows Vista (32 and 64-bit) Windows 7 (32 and 64-bit) Windows 8 (32 and 64-bit) Windows 8.1 (32 and 64-bit) Windows NT/2000 Windows Server 2003 (32 and 64-bit) Windows Server 2008 (32 and 64-bit) Windows Server 2008 R2 (32 and 64-bit) Windows Server 2012 (32 and 64-bit) Windows Server 2012 R2 (64-bit) 4

5 Encryption Support EnCase now supports the following encryption products. Vendor Product Supported Versions 64-bit Support Check Point Check Point Full Disk Encryption (formerly Pointsec PC) up to 7.4, 8.0 (for Windows and Macintosh computers) Credant Mobile Guardian 5.2.1, 5.3, 5.4.1, 5.4.2, 6.1 through 6.8, 7.3 Dell Data Protection 8.3 GuardianEdge Encryption Plus/Anywhere 7 and 8 No GuardianEdge Hard Disk Encryption 9.1.5, 9.2.2, 9.3.0, 9.4.0, 9.5.0, McAfee EndPoint Encryption (formerly SafeBoot) 4, 5, 6, 7 (for Windows and Macintosh computers) Microsoft BitLocker and BitLocker To Go Windows Vista, 7, and 8, Server 2008 Sophos SafeGuard Easy and Enterprise (formerly Utimaco) 4.5, 5.5, 5.6, 6.0 (only for SafeGuard Easy, not for Enterprise) Symantec PGP Whole Disk Encryption 9.8, 9.9, 10, 10.1, 10.2 Symantec Endpoint Encryption 7.0.2, 7.0.3, 7.0.4, 7.0.5, 7.0.6, 7.0.7, 7.0.8, 8.0, 8.2 WinMagic SecureDoc Full Disk Encryption and Self-Encrypting Drives 4.5, 4.6, 5.x, 6.x 5

6 USGCB Compliance EnCase has been validated as USGCB compliant using the following version of NIST VHD images: 10/14/11 (for Windows 7 only) EnCase was tested using Retina Network Security Scanner, which is an NIST validated USGCB scanner ( Support Technical assistance is available online at From this page you can register for and access the Guidance Software Support Portal, an invaluable resource providing product-specific technical forums, an extensive knowledge base, a bug tracking database, and an Online Submission Form for your questions. Technical Support Guidance Software offers several technical support options, including: Live Chat Support Request Form Telephone Customer Service Please direct service questions to the Guidance Software Customer Service Department: Monday Friday 7 AM 5 PM Pacific time Phone: (626) , press 5 Fax: (626) customerservice@guidancesoftware.com 1055 E. Colorado Blvd. Pasadena, CA You can access our Customer Service Request Form online at 6