Microsoft Word EnCase Forensic Version 11 User's Guide doc

545 

 

Index 

6

 

64-Bit EnCase Servlet • 19 

A

 

Acquiring • 193 

Acquiring a Disk Running in Direct ATA Mode 

• 53, 215 

Acquiring a DriveSpace Volume • 227 

Acquiring a Local Drive • 209 

Acquiring a Palm Pilot • 215 

Acquiring Device Configuration Overlays 

(DCO) and Host Protected Areas (HPA) • 53, 

210 

Acquiring Disk Configurations • 221 

Acquiring Firefox Cache in Records • 228 

Acquiring in Windows Without a FastBloc Write 

Blocker • 213 

Acquiring Non-local Drives • 219 

Acquiring SlySoft CloneCD Images • 226 

Acquiring Virtual PC Images • 226 

Acquisition Results Dialog • 202 

Acquisition Times • 219 

Acquisition Wizard • 194, 366 

Add Device • 166 

Add Device Wizard • 182 

Add Note Bookmark Dialog • 404 

Adding a Device • 188, 189 

Adding a File Viewer to Your EnCase 

Application • 288, 290 

Adding a New File Signature • 327 

Adding Keywords • 340, 343 

Adding Partitions • 247 

Adding Raw Evidence Files • 230 

Additional WinEn Information • 270 

After Acquisition Page • 195 

Alternative Report Method • 443 

America Online .art Files • 310 

Analyzing and Searching Files • 323, 490 

AND/OR Filter Logic • 135 

App Descriptors • 372 

ASCII • 519 

Associating Code Pages • 471 

Associating the File Viewer's File Types with the 

Viewer • 288, 291 

Authentication • 381 

Auto Fit • 76 

Auto Fit All Columns • 125 

B

 

Bookmark • 519 

Bookmark Content Data Types • 400 

Bookmark Data Dialog for Files • 406 

Bookmark Data Dialog for Highlighted Data 

Bookmarks • 400 

Bookmark Editing Dialogs • 417 

Bookmark Features • 399 

Bookmark Folder Information/Structure Dialog • 

405 

Bookmark Reports and Reporting • 428 

Bookmarking an Image • 315 

Bookmarking Items • 358, 395 

Bookmarking Non-English Language Text • 469 

Bookmarks Overview • 395 

Booting the Restored Hard Drive • 254 

Browse for Folder Dialog • 159, 161 

Building a Package • 503 

Burn • 519 

C

 

Canceling an Acquisition • 209 

Case Backup • 154 

Case File • 519 

Case File Format • 153 

Case File Time Zones • 169 

Case Management • 151, 152 

Case Options Page of the New Case Wizard • 

166 

Case Options Tab • 32 

Case Processor • 485 

Case Processor Modules • 487 

Case Related Features • 156 

CD-DVD Inspector File Support • 226 

Changing Filter Order • 135 

Changing Report Size • 440 

Checksum • 519 

Choose Devices Page of the Add Device Wizard 

• 187 

Choosing Database Sources • 257 

Cleaning an EDB Database • 300 

Clearing the Invalid Image Cache • 317 

Close Case • 175 

Cluster • 519 

Code Page • 519 

Color Tab • 35 

COM Folder EnScript Code • 492 

Combining Filters • 134 

Command Line Options • 267 

---

546 

 

EnCase Forensic Version 6.11 Userʹs Guide 

Guidance Software

 

Completing the After Acquisition Page of the 

Acquisition Wizard • 205 

Completing the Choose Devices Page • 192 

Completing the Destination Page • 286 

Completing the File Selection Page • 285 

Completing the Options Page • 286 

Completing the Options Page of the Acquisition 

Wizard • 208 

Completing the Preview Devices Page • 192 

Completing the Search Page of the Acquisition 

Wizard • 206 

Completing the Sessions Sources Page • 191 

Completing the Sources Page • 190 

Compound File • 519 

Compound Files • 489 

Comprehensive Internet History Search • 350 

Computer Forensics • 520 

Concurrent Case Management • 152 

Conditions • 138 

Configuration File • 269 

Configuration File Notes • 270 

Configuring Interface Elements to Display Non-

English Characters • 460 

Configuring Non-English Language Support • 

459 

Configuring the Keyboard for a Specific Non-

English Language • 461 

Configuring Your EnCase Application • 30 

Configuring Your Linux Distribution • 47 

Connection • 520 

Contract All • 117 

Copy • 148 

Copy and Unerase Features • 275 

Copy Folders Dialog • 282, 288 

Copy/UnErase • 64 

Copy/UnErase Wizard • 276 

Copying a Table Entry into a Folder • 425, 426 

Copying and Unerasing Bookmarks • 286 

Copying and Unerasing Files • 284 

Copying and Unerasing Files and Folders • 275 

Copying Folders • 287 

Create a Hash Set • 336 

Create an App Descriptor with an EnScript 

Program • 374 

Create License Dialog • 501 

Create Logical Evidence File Wizard • 239 

Creating a Bookmark • 407, 415 

Creating a Datamark as a Bookmark • 415 

Creating a File Group Bookmark • 412 

Creating a Filter • 130 

Creating a Folder Information/Structure 

Bookmark • 410 

Creating a Highlighted Data Bookmark • 408 

Creating a License • 503 

Creating a LinEn Boot Disc • 46, 514 

Creating a Log Record Bookmark • 413 

Creating a Logical Evidence File • 242 

Creating a Notable File Bookmark • 411 

Creating a Notes Bookmark • 409, 415 

Creating a Package • 502 

Creating a Report Using Case Processor • 449 

Creating a Report Using the Report Tab • 437 

Creating a Snapshot Bookmark • 414 

Creating a Webmail Report • 442 

Creating an Additional Fields Report • 447 

Creating and Defining a New Text Style • 463 

Creating Conditions • 139 

Creating Global Keywords • 339 

Creating International Keywords • 342 

Creating Non-English Keywords • 465 

CREDANT Encryption Support (File-Based 

Encryption) • 384 

CREDANT Encryption Support (Offline 

Scenario) • 387 

Customer Service • 534 

Customizing a Report • 415, 428, 430 

Cyclical Redundancy Check (CRC) • 520 

D

 

Datamarks • 399 

Dates • 402 

Decrypted Block • 320 

Deleting a Filter • 137 

Deleting Items • 128, 357 

Deleting Partitions • 249 

Destination Page of the Copy/UnErase Wizard • 

281 

Determining Local Mailbox Encryption • 318 

Device Configuration Overlay (DCO) • 520 

Disabling Microsoft Windows Vista User 

Account Control • 41 

Disk Configuration Set Acquired as One Drive • 

224 

Disk Configurations Acquired as Separate Drives 

• 225 

Disk Encryption Support • 378 

Disk Slack • 520 

Displaying Expanded Tree Entry Information • 

119 

---