Pieces0310

取证须让证物说话,莫妄以自我心证来给案情下定论.切忌画靶射箭,为找而找. 取证的根基仰赖经验与判断,在IT各领域的经验愈丰富,愈能看出端倪. 取证须善用工具,但不过度依赖工具.工具只能帮你缩小可能范围,但无法告诉你答案,仍需靠人进行分析判断.

首页 新随笔 联系 订阅 管理

hi,

My EnCase version is v7 and I found a terrible issue about index search in Unallocated area. Without Internet Evidence Finder I could not the truth of EnCase index search...Thanks God I use IEF to carve the evidence file and some webmail found..so I export those records as below Excel datasheet..guess what? I did index the evidence file and search same Simplified Chinese keywords  in the Excel datasheet..no any hits found...

Forensics is a strict science..such kind of mistakes are unacceptable..Guidence should think highly of Chinese market and do something to fix this issue as soon as possible...

 

posted on 2015-05-12 23:00  Pieces0310  阅读(372)  评论(0)    收藏  举报