EnCase 6.14.3

December 30, 2009

EnCase 6.14.3 sees exFAT logically. Some initial issues:

– The starting extent (cluster) is not parsed out correctly on the FAT. Correct on the cluster location of a file (noted in EnCase as {volume}-C{cluster}.
– Dates and times are reported in LOCAL MACHINE TIME.
– exFAT time zones not reported.
– Incorrect interpretation of deleted folders.

%d bloggers like this: