viii
EnCase Forensic Version 6.11 Userʹs Guide
Contents
Exchange Server Synchronization....................................................................................................... 303
Cleaning an EDB Database .................................................................................................................. 304
Testing an EDB File............................................................................................................................... 305
Recovering a Database.......................................................................................................................... 306
Repairing a Database ............................................................................................................................ 306
Viewing Outlook Express Email ......................................................................................................... 307
Viewing MS Outlook Email ................................................................................................................. 310
Viewing Macintosh .pax Files.............................................................................................................. 311
Viewing Windows Thumbs.db ........................................................................................................... 313
America Online .art Files...................................................................................................................... 314
Viewing Office 2007 Documents ......................................................................................................... 315
Viewing Base64 and UUE Encoded Files ................................................................................................ 316
NTFS Compressed Files ............................................................................................................................. 318
Gallery Tab .................................................................................................................................................. 318
Bookmarking an Image ........................................................................................................................ 319
Reducing the Number of Images Per Row ........................................................................................ 320
Increasing the Number of Images Per Row....................................................................................... 320
Clearing the Invalid Image Cache....................................................................................................... 321
Lotus Notes Local Encryption Support ................................................................................................... 321
Determining Local Mailbox Encryption............................................................................................. 322
Parsing a Locally Encrypted Mailbox................................................................................................. 322
Encrypted Block .................................................................................................................................... 323
Decrypted Block .................................................................................................................................... 324
Locally Encrypted NSF Parsing Results............................................................................................. 325
CHAPTER 9 Analyzing and Searching Files
327
Signature Analysis ...................................................................................................................................... 328
File Signatures ....................................................................................................................................... 328
File Signatures with Suffixes................................................................................................................ 329
Viewing the File Signature Directory ................................................................................................. 329
Adding a New File Signature .............................................................................................................. 331
Editing a Signature................................................................................................................................ 332
Performing a Signature Analysis ........................................................................................................ 333
Viewing Signature Analysis Results (Part 1)..................................................................................... 334
Viewing Signature Analysis Results (Part 2)..................................................................................... 335
Signature Analysis Legend .................................................................................................................. 336
EnScript Programming Language ............................................................................................................ 337
Included Enscript Components........................................................................................................... 337
EnScript Types....................................................................................................................................... 338
Hash Analysis.............................................................................................................................................. 338
File Hashing................................................................................................................................................. 339
Hash a New Case .................................................................................................................................. 339
Hash Sets...................................................................................................................................................... 340
Create a Hash Set .................................................................................................................................. 340
Rebuild a Hash Library ........................................................................................................................ 342
Viewing Hash Search Results .............................................................................................................. 342
Keyword Searches ...................................................................................................................................... 343