Microsoft Word EnCase Forensic Version 11 User's Guide doc
Yüklə 2,21 Mb. Pdf görüntüsü
|
- Bu səhifədəki naviqasiya:
- Add Device
- Tree pane
- Panes in the Analysis Cycle
- Panes as Separate Windows
- Pane Features
Navigating the EnCase Interface 81
New displays the Case Options wizard where a new case is defined. Open displays the Open dialog where you can open an existing case. Print displays the Print dialog. Refresh updates a list or table to reflect changes made in the file system to files that drive the EnCase application. Save displays, once a case is opened, the Save dialog. Add Device displays, once a case is opened, the Add Device wizard, so that a device can be previewed or acquired. Search displays the Search dialog, so that evidence associated with the case can be searched. Logon displays the Logon dialog, so that you can log on to the SAFE. This icon only appears in enterprise applications. Logoff logs you off the SAFE. This icon only appears after you have logged on to the SAFE. Other icons are described in the context where they appear.
82
EnCase Forensic Version 6.11 Userʹs Guide
Most EnCase work is done from one of the panes in the main display. The current display contains four panes containing different data and displays. These include the following:
You can separate each pane from the main window and display them as individual windows.
Navigating the EnCase Interface 83
Panes drive and organize the evidence analysis cycle. The evidence cycle is where you define your investigation of acquired evidence. Analysis of evidence is cyclical, because you will redefine selection and processing as your analysis requirements evolve during the investigation. Figure 8 Panes in the Analysis Cycle, where 1) container entries selected in the Tree pane determine the contained entries that appear in the Table pane, 2) contained entries selected in the Table pane determine the contents that appear in the View pane, 3) optionally, filters, searches, and processing defined in the Filters pane narrow the contents or results of the analysis that appear in the View pane, 4) results of the current analysis cycle, and 5) subsequent refinements of the analysis.
The tree pane provides you with the starting point of the analysis. This is where you select the container entries, such as devices and folders that contain the evidence you want to examine. The Table pane presents the contents of the entries selected in the Tree pane. You can refine entries to be examined here. The Filters pane gives you the means to search, filter, and automate the examination of the entries selected for examination in the Tree and Table panes. This narrows and focuses your analysis effort. The Filter pane provides tabs that enable you to view analytical results in places other than the View pane. The View pane provides various tools that help you explore and see the results of the analysis. If the results of the analysis are sufficient for your purposes, the analysis can move on to other aspects of the investigation. If not, the analysis can be redefined and performed again.
84
EnCase Forensic Version 6.11 Userʹs Guide
The individual panes that appear in the main window can be displayed in separate windows. In the main window, each pane has a drag handle. You can drag the pane outside the main window and the pane will appear in a secondary window. Once three panes are dragged from the main window, the remaining pane does not display a drag handle and remains associated with the main window. The panes cannot be dragged back into the main window. Refreshing the view displayed in the main window places all the panes back in the main window in their usual location.
Navigating the EnCase Interface 85
Figure 9 Panes appearing as secondary windows, showing the Tree pane, Table pane, and Filter pane as separate windows. The View pane appears in the main window where the Reset view command is selected from the View menu. The Reset view command puts the panes appearing in separate windows back into the main window.
86
EnCase Forensic Version 6.11 Userʹs Guide
Use pane features while working with panes and their tabs. Each pane can display these features:
Tabs and tab bar Scrollbar in the tab bar for a resized pane
Controls in the tab bar Grab handle Figure 10 Pane Features, where 1) is a View pane, 2) is the current tab, 3) is the tab bar, 4) is the scroll icon for navigating the tab bar, so that the tab you want to use can be displayed, 5) is the drag handle used to drag the pane out of the main window, so it appears in a secondary window, and 6) care commands controlling the tab bar.
Each pane contains one or more tabs. As the main window is resized, the tab toolbar resizes correspondingly. When a pane is resized to a size not as wide as its toolbar, the tabs are hidden and a scroll icon appears. The scroll icon lets you scroll to the right or left so you can view the hidden tabs. You can wrap the tabs, rather than having them hidden, by using AutoFit on the right‐click menu of the tab toolbar. The tab toolbar may contain controls in addition to tabs. The scrollbar exposes these controls as well as tabs when either is hidden. Yüklə 2,21 Mb. Dostları ilə paylaş:
|