I use histex against an entire PDE mounted disk or a beta version that runs accross the e.01 evidence files (without having to mount at all).
So if you run histex against the "unallocated clusters" file or a pagefile larger than 4gb served by VFS it will not have the opportunity to parse all the data thus seeming to miss stuff. Therefore for example if your "unallocated clusters" file is 16 gb VFS will repeat the first 4 gb of the file four times. Hi Again, Encase VFS has (I believe the issue is still unresolved) a bug which causes it to present only the first 4gb of any file greater than 4gb. I knew about the history entries because they resided with in UA as keyword search hits that were not being populated in Netanalysis after extraction DC1743 It would run but missed results very important to the case. I was using HistExtractor on pagefile and unallocated space with VFS. I know that the developer - Craig Wilson - is very responsive in fixing issues. Please may I ask how the history extractor was run? Was it against a live write blocked physical disk or was Encase PDE or VFS or another method used? I use Histex routinely and have not encountered significant problems. Also I am currently working a case where net analysis history extractor has missed a substantial part of the history in unallocated space or page files. I don't know if I am the only one to try and use this but the EnPack has a license protection on it for GSITraining. Hi, Notwithstanding the use of this enscript for other third party tools, NetAnalysis itself has a component called Histex which is designed to parse internet history from unallocated, page file etc.
0 kommentar(er)
