Last week my friend brought me an evidence file duplicated from a Linux server, which distribution is CentOS 5.0 and the i18n is zh-tw. She wanna know whether there is any malware on this Linux server or not. OK. Let's get to work. I add this evidence and do Evidence Process. Guess what??? EnCase could not  recognize Chinese character folder names / filenames, and those folder names / filenames become Hieroglyphics. I am very disappointed and don't know what to say to my friend... I guess I have to explain why EnCase may need night vision goggles when examining Linux platform evidence files. It's too ridiculous!

Needless to say, my friend also could not believe the #1 forensic tool - EnCase should have problems like that. Fortunately I still have another options like FTK or X-Ways Forensics to take over this case. You guys could take a look at screenshot below. I mount these evidence files by using FTK Imager Lite. You could see the Chinese character folder names / filenames now. I'd like to remind you that FTK Imager Lite is a free tool...

EnCase v7 could not recognize Chinese character folder names / file names on Linux Platform的更多相关文章

  1. [DFNews] EnCase v7.08发布

    EnCase v7.08 近日正式发布,7.08增加了Evidence Processor Manager以及Evidence Processor,不仅可以在本地实现证据处理队列,也支持了通过网络进行 ...

  2. IEF could not decode Chinese character in IE history well

    My friend is working on some case, and she looks not in the mood. I ask her what's going on. She wan ...

  3. EnCase v7 search hits in compound files?

    I used to conduct raw search in EnCase v6, and I'd like to see if EnCase v7 raw search could hit key ...

  4. Fix Some bytes have been replaced with the Unicode substitution character while loading file XXX.cs with Chinese Simplified (GB2312) encoding

    When we use <strong>visual studio</strong> open source file or any other file, we may en ...

  5. GitHub & puppeteer & Chinese character & bug

    GitHub & puppeteer & Chinese character & bug https://github.com/GoogleChrome/puppeteer/b ...

  6. Python“Non-ASCII character 'xe5' in file”报错问题(转)

    今天在编译一个Python程序的时候,一直出现"Non-ASCII character 'xe5' in file"报错问题 SyntaxError: Non-ASCII char ...

  7. python 运行时报错误SyntaxError: Non-ASCII character '\xe5' in file 1.py on line 2

    File "1.py", line 2SyntaxError: Non-ASCII character '\xe5' in file 1.py on line 2, but no ...

  8. SyntaxError: Non-ASCII character '\xe7' in file解决方法

    SyntaxError: Non-ASCII character '\xe7' in file 出现这种错误的原因是程序中的编码出问题了,只要在程序的最前面加上 最前面的意思是在最前面,包括在注释的前 ...

  9. python 遇到 syntaxerror: non-ascii character '/xd6' in file 我 教你解决 （python问题）（转）

    遇到标题上的问题,按照我的解决广方案来吧 ＝＝＝＝＝＝＝＝＝＝＝＝＝＝＝＝＝＝＝＝＝＝＝＝＝＝＝＝＝＝＝＝＝＝＝＝＝ (一) 用记事本创建一个文件ChineseTest.py,默认ANSI: s = ...

随机推荐

  1. ylbtech-Unitity-cs:传递的字符串中数字字符的数目

    ylbtech-Unitity-cs:传递的字符串中数字字符的数目 1.A,效果图返回顶部   1.B,源代码返回顶部 1.B.1, using System; namespace Functions ...

  2. [C语言]（二）01 获取Windows图形构件大小信息

    SYSMETS.c #include <windows.h> #include "SYSMETS.H"//自定义的单元,所以用"",不是用<& ...

  3. IDEA Community(社区版) 使用Maven创建Web工程 并部署tomcat

    由于IDEA社区版(Community)无法直接New一个Web Appplication 所以要使用maven来创建 1.创建一个Project 2. 3. 4.这里在Properties中添加一个 ...

  4. dede:arclist 如何调用文章正文？

    {dede:arclist flag=h typeid=2 row=1 titlelen='200' orderby=pubdate}<div class="data-news&quo ...

  5. [Flex] ButtonBar系列——如何给ButtonBar添加一个ViewStack

    <?xml version="1.0" encoding="utf-8"?> <!--如何给ButtonBar添加一个ViewStack--& ...

  6. HTML readyState 属性 iframe onreadystatechange事件

    -----------readyState--------------- 定义和用法 readyState 属性返回当前文档的状态(载入中……). 该属性返回以下值: uninitialized - ...

  7. JAVA 回调

    一.定义        回调就是把函数指针做为参数传入,如函数A做为参数传入函数B,由B函数决定何时.何地调用函数A, function A() function B(A)    {         ...

  8. 关于ie6下拖动滚动条时,div抖动的问题解决

    你如果遇到了这个问题,算是你有福了. 首先说非ie6下的div不随滚动条变化而移动位置的. 1,首先在body中写足够多的文字,一直到浏览器出现滚动条.例如你可以拼命的放P,足够多的P标签 2建立一个 ...

  9. (medium)LeetCode .Implement Trie (Prefix Tree)

    Implement a trie with insert, search, and startsWith methods. Note:You may assume that all inputs ar ...

  10. 【LOB】使用USER_LOBS视图获得当前用户包含LOB字段的表

    包含LOB类型字段的表往往需要特殊关照,如何快速的获得包含LOB对象的数据库表?使用DBA_LOBS.ALL_LOBS和USER_LOBS视图可以很方便地获得包含BLOB或CLOB字段的表. 简单看一 ...