EnCase v7 could not recognize Chinese character folder names / file names on Linux Platform
Last week my friend brought me an evidence file duplicated from a Linux server, which distribution is CentOS 5.0 and the i18n is zh-tw. She wanna know whether there is any malware on this Linux server or not. OK. Let's get to work. I add this evidence and do Evidence Process. Guess what??? EnCase could not recognize Chinese character folder names / filenames, and those folder names / filenames become Hieroglyphics. I am very disappointed and don't know what to say to my friend... I guess I have to explain why EnCase may need night vision goggles when examining Linux platform evidence files. It's too ridiculous!
Needless to say, my friend also could not believe the #1 forensic tool - EnCase should have problems like that. Fortunately I still have another options like FTK or X-Ways Forensics to take over this case. You guys could take a look at screenshot below. I mount these evidence files by using FTK Imager Lite. You could see the Chinese character folder names / filenames now. I'd like to remind you that FTK Imager Lite is a free tool...
最新文章
- C和指针 第十七章 二叉树删除节点
- 多功能扫描打印读卡一体手持POS终端
- 关于cocoa框架，你所要知道的一切(苹果官方文档，cocoa框架核心竞争力，必须收藏！)
- Little Kings - SGU 223（状态压缩）
- Git Push 不用再次输入用户名和密码方法
- 织梦 {dede:list}列表按多种排序显示
- bitmap 内存溢出OOM的解决办法分享
- Java IO最详解
- 实验五：任意输入10个int类型数据，排序输出，并找出素数
- markdown改变字体颜色和大小
- 转：甲骨文发布大数据解决方案 含最新版NoSQL数据库
- MVC初级教程（一）
- C#反射的一些经验[转载]
- [Python] First-class Everything (Python缔造者Guido van Rossum关于bound/unbound method的来历叙述)
- 大数据中HBase的Java接口封装
- Ubuntu 18.04开发环境部署流程
- 从SQL Server中清除msdb备份和恢复记录
- 安装mysql5.7后无法启动，/var/run/mysqld 目录每次重启后都需要手动去创建--终极解决方案
- Max answer(The Preliminary Contest for ICPC China Nanchang National Invitational)
- 【现代程序设计】homework-02