EnCase Examiner Version Release Notes

Transcription

1 EnCase Examiner Version Release Notes May 7, 2014 EnCase Thank you for using Guidance Software products. The Release Notes for this version of EnCase contain important information regarding your EnCase application. Before you install, we recommend that you read the Release Notes to better understand the changes we have made. SAFE Version The SAFE version for this release is 7j4. The OS X servlet was rebuilt due to a new Guidance Software code signing certificate. Item Fixed CORE - 502: During evidence processing via Outside In, the Transcript view showed unreadable text after indexing case transcripts generated. The view contained invalid characters that could affect index search results. This is now fixed. and is provided for informational purposes only.

2 Known Limitations Found in Version : After several iterations of running Case Analyzer and bookmarking, when clicking on a bookmark created with Case Analyzer, EnCase may crash. Found in Version : In some instances when running Snapshot, either via the Evidence Processor or the Sweep Enterprise EnScript, the target may become unresponsive and cause a reboot. Workaround: Add this registry entry: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersio n\setup] Add enstartopts Value=dword: : When using the Review tab to view keywords in larger files (for example, 3 or 4 GB), EnCase may freeze while the file is copied to the temp directory. Found in Version : Linux implements special characters (such as German umlauts) using Unicode UTF-8 encodings, but EnCase by default does not decode these 2-byte UTF-8 encodings when it displays the file and folder names. Workaround: Change the Code Page to UTF-8 to see characters with codes above 127. Setting the Code Page in EnCase to UTF-8 if the locale is unknown is better than using the default when an evidence or dd image acquired from *NIX is added to EnCase : Outside In: EnCase hangs while viewing some.mif files. Found in Version : EnCase becomes unstable when you drag and drop evidence into a case while a sort operation is running. Found in Version : The sparse size of an Ubuntu ext3 file is improperly reported : Some compound index queries with NOT terms do not yield correct results. 2

3 Found in Version : EnCase returns empty records when the Sweep Enterprise Snapshot module takes more than ten minutes to run on a machine. This causes EnCase to time out, and fails to return any snapshot data for that machine. When this happens you can reboot the machine that returns these empty records and rerun Sweep Enterprise with the Snapshot module on. Note: The Sweep interface does not tell you which targets return no data. To get that information, you must query the Sweep.sqlite database using a query of this form: (Select B.Target From Snapshot as A, _TargetRuns as B Where A._TargetRuns_Key = B.ID and A.Name = ). The Sweep database is stored in the Case folder, under EnScript/Sweep Enterprise. Found in Version : When acquiring data from Acer tablets, only some Gmail messages from the inbox are able to be parsed. Gmail messages in drafts and other folders are not captured in the logical evidence file. This is due to a change in how Gmail caches information. In addition, the default Acer application does not provide read access to its data, so no messages from the default application can be acquired. Found in Version : Index hits with large numbers of characters that wrap over line breaks do not display in the Review tab. Guidance Software Product Compatibility Tables The Support Portal contains a list of version-to-version compatibility tables for all Guidance Software products at 3

4 Target Machine Operating Systems Servlets are deployed on target machines and can be used to search the following operating systems: AIX 4.3, 5.1, 5.2, 5.3, 6.1, 7.1 HPUX 11.0, 11.1x, 11.2x Linux Kernels (32 and 64-bit) or (32-bit) or higher with Process File System (procfs) NetWare 5.1 SP8, 6.0 SP4, 6.5 Mac OS X 10.2 through (32 and 64-bit, Intel, and PPC) Solaris 8, 9, 10 (32 and 64-bit, SPARC only) Windows XP (32 and 64-bit) Windows Vista (32 and 64-bit) Windows 7 (32 and 64-bit) Windows 8 (32 and 64-bit) Windows NT/2000 Windows Server 2003 (32 and 64-bit) Windows Server 2008 (32 and 64-bit) Windows Server 2012 (64-bit) Encryption Support EnCase now supports the following encryption products. Vendor Product Supported Versions 64-bit Support Check Point Check Point Full Disk Encryption (formerly Pointsec PC) up to 7.4, 8.0 (for Windows and Macintosh computers) Credant Mobile Guardian 5.2.1, 5.3, 5.4.1, 5.4.2, 6.1 through 6.8, 7.3 GuardianEdge Encryption Plus/Anywhere 7 and 8 No GuardianEdge Hard Disk Encryption 9.1.5, 9.2.2, 9.3.0, 9.4.0, 9.5.0, McAfee EndPoint Encryption (formerly SafeBoot) 4, 5, 6, 7 (for Windows and Macintosh computers) Microsoft BitLocker and BitLocker To Go Windows Vista, 7, and 8, Server

5 Sophos SafeGuard Easy and Enterprise (formerly Utimaco) 4.5, 5.5, 5.6, 6.0 (only for SafeGuard Easy, not for Enterprise) Symantec PGP Whole Disk Encryption 9.8, 9.9, 10, 10.1, 10.2 Symantec Endpoint Encryption 7.0.2, 7.0.3, 7.0.4, 7.0.5, 7.0.6, 7.0.7, 7.0.8, 8.0, 8.2 WinMagic SecureDoc Full Disk Encryption 4.5, 4.6, 5.x, 6.x USGCB Compliance EnCase has been validated as USGCB compliant using the following version of NIST VHD images: 10/14/11 (for Windows 7 only) EnCase was tested using Retina Network Security Scanner, which is an NIST validated USGCB scanner ( Support Technical assistance is available online at From this page you can register for and access the Guidance Software Support Portal, an invaluable resource providing product-specific technical forums, an extensive knowledge base, a bug tracking database, and an Online Submission Form for your questions. Technical Support Guidance Software offers several technical support options, including: Live Chat Support Request Form Telephone 5

6 Customer Service Please direct service questions to the Guidance Software Customer Service Department: Monday Friday 7 AM 5 PM Pacific time Phone: (626) , press 5 Fax: (626) customerservice@guidancesoftware.com 1055 E. Colorado Blvd. Pasadena, CA You can access our Customer Service Request Form online at 6