Pieces0310

取证须让证物说话,莫妄以自我心证来给案情下定论.切忌画靶射箭,为找而找. 取证的根基仰赖经验与判断,在IT各领域的经验愈丰富,愈能看出端倪. 取证须善用工具,但不过度依赖工具.工具只能帮你缩小可能范围,但无法告诉你答案,仍需靠人进行分析判断.

首页 新随笔 联系 订阅 管理

My friend she showed me a screenshot as below yesterday. The name of this document is “EnCase Forensic Features and Functionality”. She asked me that why some feature is missing in her EnCase Forensic software???

 

 

Then she showed me what’s missing in her EnCase as below. She said to me that’s it – “Active Directory Information Extractor”. It’s very interesting. I’ve been using EnCase for such a very long time and I’ve never seen this feature before.

 

 

I conduct an investigation on it and it seems that it’s an EnScript as below:

This EnScript is designed to extract the Username (Both Displayname and Login Name), the SID, the Home directory, the Email address of each User and the Last Login, Last Failed Login, and Next Password Change dates for each account. Existing Group Names are also located and presented.

 

Now my question is where to get this EnScript and what version of Windows Server it supports. I’d appreciate your providing me any info you have. Thanks.

posted on 2016-06-25 13:04  Pieces0310  阅读(396)  评论(0)    收藏  举报