An EnCase image is a proprietary file type created by Guidance Software's EnCase software for use with its software packages. Finally, to answer your question, follow these instructions. Use Encase to open the drive after the document has been deleted.
Here I open an event log file extracted from Windows XP system in EVTX for my forensic investigation.EnCase is a suite digital forensics products by Guidance Software. If you need a low cost means of processing and reviewing your ediscovery, you should check out FreeEDD. I'm working on forensics tools and I have Encase E01 type image file.Commercial open source: Not relevant for EnCase Forensic The customer can acquire the system free of cost without having to incur any upfront license fee. The file’s properties window appears on the screen. How to open encase files central file server and copies in case file placed on each investigator's computer (since case files cannot be accessed by more than one person at a time).
