I have discovered what I believe to be a flaw in the EnCase program used by some members of this community. I would like to publish this information in the hopes that it will assist law enforcement officers and agencies in dealing with computer crime investigations. The flaw involves directories that appear empty in EnCase, but when viewed in Windows actually contain files, folders and deleted file information. This is more of an aesthetic issue than a real killer. A skilled investigator might be able to identify the problem, if they know what to look for and how to find it. The quickest and easiest way to demonstrate this issue is: 1) format a floppy disk 2) place files and folders on the disk 3) within the entry for a sub-folder, shift the contents of the directory entry up by 64 bytes, overwriting the "dot - double dot" directory thread entries. At this point, Windows is still able to display the contents of the directory, but EnCase shows the directory as "empty". Accordingly, any directories within the affected directory are not visible within the logical file structure presented by EnCase, nor are their contents. Files may be created, deleted, etc. within the affected directory and are not displayed in the "all files" view. In Disk view, the clusters occupied by the "hidden" entries will appear as orphaned. If you are using any version of EnCase and see a folder that appears "empty", please be aware of this and make sure you are not missing files and folders that are visible to Windows and other programs. Maintaining a linked list of directory clusters (the way windows does) will solve this problem. Assuming that the directory structure is intact is not always a valid assumption. Regards - Andrew Rosen ASR Data Acquisition & Analysis, LLC - Austin, Texas ==================================================== Voice: 512-918-9227 (GMT -6 hrs) Fax : 512-918-9393 EMail: andrewat_private WWW : http://www.asrdata.com ====================================================
This archive was generated by hypermail 2b30 : Mon May 14 2001 - 08:45:39 PDT