How To Use Encase On A Computer Or A Hard Drive (For A Computer)

(1)

EnCase® Version 7.10.01

Release Notes

October 3, 2014

EnCase Version 7.10.01

Thank you for using Guidance Software products.

The Release Notes for this version of EnCase contain important information regarding your EnCase application. Before you install, we recommend that you read the Release Notes to better understand the changes we have made.

SAFE Version

(2)

2

New Features

OS X 10.9.4 Servlet Support

EnCase now provides servlet support for Macintosh OS X 10.9.4.

Enhanced SQLite Support

EnCase now supports SQLite version 3.8.5.

Linux Logical Volume Manager (LVM) Symmetric and Asymmetric

Support

EnCase now provides LVM symmetric and asymmetric support for Linux RAID 5 disks.

Items Fixed

CORE-1585: In the Search tab, if one or more entries is selected and acquired to a LEF, subsequent entries are now added to the existing LEF successfully.

CORE-1482: Clicking an index hit line number in the Review tab did not go to the specific hit in the

Transcript tab. This is fixed.

CORE-1429: The True Path column in Records view did not display correct path information for thumbnails and Internet artifacts. This is fixed.

CORE-1427/69221: EntryClass should provide an accurate Linux path for logical drives. There is a new function on EntryClass called GetMachinePath that returns the best guess for the OS dependent location of the entry.

CORE-1380: In Entries view, the true path of any entry displayed two backslashes after the case file name. This is fixed.

CORE-1376: Connection to HPUX dropped after adding and mounting devices and performing Scan LVM. This is fixed.

CORE-1374: Disk view displayed non-primary FAT sectors as primary FAT. This is fixed.

CORE-1373: Auto Extents did not display correctly in Disk view for files on an exFAT formatted drive. This is fixed.

CORE-1370/69762: Parsing MFT over a SAFE network preview took an excessive amount of time. This is fixed.

CORE-1369: The process of updating reports while running Analysis Browser caused EnCase to hang. The upgrade to SQLite 3.8.5 fixes this.

(3)

3

CORE-1102/69865: A FileVault 2 volume was not parsing over a SAFE network, and it was not possible to view the decrypted core storage file structure. This is fixed.

SR-267391: A case had a folder with only one file with a logical size of zero, but CredDB.CEF showed it as encrypted. This is fixed.

Known Limitations

Found in Version 7.10

CORE-1527: The 32 and 64-bit EnCase servlet requires the Windows Management Interface (WMI) service for installation and operation on Windows 8, Windows 8.1, Windows Server 2012, and Windows 2012 R2.

TS-141: File Carver may display a status of 100 percent complete, but continue to process or crash EnCase. This situation is caused by File Carver searching for numerous file types, including headers leading with "..." Guidance Software recommends that you perform file carving for file types with "..." leading headers separately.

CORE-1322: When exporting items in Search Results, if Add to existing evidence file is selected, EnCase will crash.

CORE-895/69792: The index uses all caps by default; so, for example, DOBBS is the only possible hit for a search on <c>DOBBS. <c>dobbs, <c>Dobbs, and all other case variations are in a different set.

Found in Version 7.09.04

69649: After several iterations of running Case Analyzer and bookmarking, when clicking on a bookmark created with Case Analyzer, EnCase may crash.

Found in Version 7.09.02

68889: Outside In: EnCase hangs while viewing some .mif files.

Found in Version 7.08.01

67028: EnCase becomes unstable when you drag and drop evidence into a case while a sort operation is running.

Guidance Software Product Compatibility Tables

The Support Portal contains a list of version-to-version compatibility tables for all Guidance Software products at https://support.guidancesoftware.com/matrix.

(4)

4

Target Machine Operating Systems

Servlets are deployed on target machines and can be used to search the following operating systems:  AIX 4.3, 5.1, 5.2, 5.3, 6.1, 7.1

 HPUX 11.0, 11.1x, 11.2x

 Linux Kernels 2.6.9 (32 and 64-bit) or 2.6.4 (32-bit) or higher with Process File System (procfs)  NetWare 5.1 SP8, 6.0 SP4, 6.5

 Mac OS X 10.2 through 10.9.2 (32 and 64-bit, Intel, and PPC)  Solaris 8, 9, 10 (32 and 64-bit, SPARC only)

 Windows XP (32 and 64-bit)  Windows Vista (32 and 64-bit)  Windows 7 (32 and 64-bit)  Windows 8 (32 and 64-bit)  Windows 8.1 (32 and 64-bit)  Windows NT/2000

 Windows Server 2003 (32 and 64-bit)  Windows Server 2008 (32 and 64-bit)  Windows Server 2008 R2 (32 and 64-bit)  Windows Server 2012 (32 and 64-bit)  Windows Server 2012 R2 (64-bit)

(5)

5

Encryption Support

EnCase now supports the following encryption products.

Vendor Product Supported Versions 64-bit Support

Check Point Check Point Full Disk

Encryption (formerly Pointsec PC)

6.3.1 up to 7.4, 8.0 (for Windows and

Macintosh computers) Yes

Credant Mobile Guardian 5.2.1, 5.3, 5.4.1, 5.4.2, 6.1 through 6.8, 7.3

Yes

Dell Data Protection 8.3 Yes

GuardianEdge Encryption Plus/Anywhere 7 and 8 No GuardianEdge Hard Disk Encryption 9.1.5, 9.2.2 , 9.3.0,

9.4.0, 9.5.0, 9.5.1

Yes

McAfee EndPoint Encryption (formerly SafeBoot)

4, 5, 6, 7 (for Windows and Macintosh computers)

Yes

Microsoft BitLocker and BitLocker To Go Windows Vista, 7, and 8, Server 2008

Yes

Sophos SafeGuard Easy and Enterprise (formerly Utimaco)

4.5, 5.5, 5.6, 6.0 Yes (only for SafeGuard Easy, not for

Enterprise) Symantec PGP Whole Disk Encryption 9.8, 9.9, 10, 10.1, 10.2 Yes Symantec Endpoint Encryption 7.0.2, 7.0.3, 7.0.4,

7.0.5, 7.0.6, 7.0.7, 7.0.8, 8.0, 8.2

Yes

WinMagic SecureDoc Full Disk Encryption and Self-Encrypting Drives

(6)

6

USGCB Compliance

EnCase has been validated as USGCB compliant using the following version of NIST VHD images: 10/14/11 (for Windows 7 only)

EnCase was tested using Retina Network Security Scanner, which is an NIST validated USGCB scanner (http://usgcb.nist.gov/usgcb/microsoft_content.html).

Support

Technical assistance is available online at

http://www.guidancesoftware.com/technical-support.htm. From this page you can register for and access the Guidance Software Support Portal, an invaluable resource providing product-specific technical forums, an extensive knowledge base, a bug tracking database, and an Online Submission Form for your questions.

Technical Support

Guidance Software offers several technical support options, including:  Live Chat

 Support Request Form  Email

 Telephone

Customer Service

Please direct service questions to the Guidance Software Customer Service Department: Monday–Friday 7 AM–5 PM Pacific time

Phone: (626) 229-9191, press 5 Fax: (626) 229-9199

Email: customerservice@guidancesoftware.com 1055 E. Colorado Blvd.

Pasadena, CA 91106-2375

You can access our Customer Service Request Form online at