Tech Support > Computers & Technology > Computer Security > Encase 4.20 (the premier computer forensics tool) Posted
Encase 4.20 (the premier computer forensics tool) Posted
Posted by nemo outis on December 11th, 2004


If you haven't tested it, you don't really know whether you're
secure. QA/QC is a vital part of any security/privacy program.

Accordingly, many would like to to test their security
arrangements against serious forensic tools, such as those used
by major LE organizations. Well, they're in luck! Encase 4.20
(the latest and greatest of the heaviest of the heavyweights) has
just been posted in alt.binaries.warez.win95-apps

Regards,

PS The posted version includes docs, but those who wish to
have the **complete kit** will nip on over to the Encase site,
www.guidancesoftware.com, and hoover down the scripts and
filters (which are not included in the posted version but are
available at the site). Better be quick about it - Encase may
clue in and pull them!



Posted by tokaj on December 11th, 2004


Max can you assist me a bit ???
"Max Mustermann" <anonymous@remail.amessage.info> wrote in message
news:52cd601f2ab3385d7701159d8406de63@remail.amess age.info...


Posted by Sheldon Botha on December 11th, 2004


Hey cipher

Ive updated my disk, it now runs TC3 and Eraser 5.7, if you want a copy
gimme a shout n ill send u the url.

Cheers

Sheldon


Posted by tokaj on December 11th, 2004



How do I combine this prog. downloaded it all incl. material from encase
site.
Use Eraser from pgp or Bestcrypt or Heidi but never checked it myself if it
is succesfull
So n'bit of newbee.

tokaj

"Max Mustermann" <anonymous@remail.amessage.info> wrote in message
news:038052d9dfd84fd40156313744128058@remail.amess age.info...


Posted by autodog on December 11th, 2004


Hello Sheldon, any chance that I can get that url from you?



On Sat, 11 Dec 2004 18:37:49 GMT, "Sheldon Botha"
<necro1234@yahoo.com> wrote:


Posted by tokaj on December 11th, 2004


Yes that clear, busy doing so thanks so far
Tokaj
"Max Mustermann" <anonymous@remail.amessage.info> wrote in message
news:87b53d94c7076f0ee4c838c6edf76bc3@remail.amess age.info...
On Sat, 11 Dec 2004, "tokaj" <nobody@dot.net> wrote:
You need to have Winrar to combine the files. I don't know if Winzip will
work the same way as I only use Winrar. Extract each of the zipped files
using Winzip or Winrar. You will wind up with files listed as following:

crack.zip
encse420.r00
encse420.r01
encse420.r02
encse420.r03
encse420.r04
And some *.nfo files (information) Open them with notepad.


Assuming you have Winrar installed:
Right click on encse420.r00 and using Winrar extract to C:/encse420. Winrar
creates the directory, combines the files to create the encase program file
(EnSetup420.exe) and the manual (EFE_Manual_English_rev420_C.pdf).

Run EnSetup420.exe and install Encase. Don't restart your computer after
the install. Next, extract the file from the Crack.zip file named
Enhkey.dll. Copy Enhkey.dll into C:\WINDOWS\SYSTEM32 directory (XP) and
replace the existing file that was put there by Encase during the install
with the cracked file. If your using something other than XP, search
Windows or your OS directory for the location of Enhkey.dll and overwrite
it with the one from the crack.zip file.

Reboot you computer. Encase is now ready to run.

Start Encase and go to the help pull down menu. Click on about encase:
You should see the following:

Thank you for using EnCase.www.encase.comVersion 4.203B00000030 10/27/04
05:07:48PMSales and Technical Support: (626) 229-9191Dongle ID #12345678
Name: Registered User Order #12345EnCase® is a registered trademark of
Guidance Software. All rights reserved.

You will have to read the PDF file to learn how to use it. It is a very
powerful program and is not intuitively obvious on how to check your
system. I can't help much here as I am still learning the new version. The
previous version for Win 98 was pretty simple by comparison.

If you don't have Winrar, see the following link to find which newsgroup to
download it from:

http://www.newzbin.com/search/query/...=-1&searchFP=p

Hope this helps and good luck.



Posted by tokaj on December 11th, 2004


Look into it think it is wise.
Thanks
"Max Mustermann" <anonymous@remail.amessage.info> wrote in message
news:ff32f0e96da033802f0f98f8a8aa9b8a@remail.amess age.info...


Posted by tokaj on December 11th, 2004


Maybe it works already ????
"tokaj" <nobody@dot.net> wrote in message
news:41bb5a5e$0$218$58c7af7e@news.kabelfoon.nl...


Posted by winged on December 11th, 2004


Sigh, I must live a totally unexciting life, I have no data in my life I
must so utterly destroy. At least none I would put on an exposed
computer....Never tell where the body is buried....

Cover my browsing tracks? From who? If you are on a network the network
sys admin can log or recover, and possibly replicate all IP activity,
and usually decipher the activity that was occurring. Shucks we can go
back a year and look at traffic. If it's your wife, she prolly doesn't
even know how to undelete a file, if it's from the police, there is an
electron microscope scanner that makes "any" amount of erasure/overwrite
a mute point, if they want the data bad enough, but they would probably
just ask your ISP for the records they are required by law to keep. If
sufficiently warranted they would place a sniffer in the pipe and record
replicate and possible view all network activity (The Patriot act makes
even a search warrant unneeded). Shucks, it would raise flags that I
had a user who needed this capability and I would just put a hidden
process key logger on the system and they could erase things all day
long. Lamplight the system and it wouldn't matter much what the user
"did" to hide tracks (except totally destroying the HDD).

So I have to ask a silly question; What does this total analization of
browser tracks do? Why on earth does one need it? I am really curious.

Winged


tokaj wrote:

Posted by nemo outis on December 11th, 2004


In article <cpg30n$f0s@dispatch.concentric.net>, winged <winged@nofollow.com> wrote:

It's 1935. I live in Germany, a civilized country in the heart
of Europe, which is at peace. Why should I, a Jew, worry about
entering my religion on the census form? After all, my privacy
is guaranteed.

Regards,


Posted by nemo outis on December 11th, 2004


In article <cpg30n$f0s@dispatch.concentric.net>, winged <winged@nofollow.com> wrote:

My name is Robert Bork. After a long career, I have been
nominated for a seat on the Supreme Court. But it comes to light
that I have rented pornographic videos. REsult: appointment shot
to hell!

But why should I worry about privacy?

Regards,


Posted by winged on December 12th, 2004


Leythos wrote:
who does understand how little privacy is involved in communications
once it hits the wire or your hard drive. This will be the last cross
post...(really)! Any future comments will go only to alt.computer.security.

I was trying to make the point, unless the media is totally destroyed
(shredded and burned at high heat) it can be recovered, with enough time
and resources. If the person you are worried about has access to the
media, given the appropriate resources and desire, data stored on the
media is available. If I were a governmental authority it would be much
easier to just monitor the communication. If your anonymizer host is in
the US, you are not hidden from authorities (read user
agreement)backtracking communication. If it is outside the US the
communication is still not "safe". Even Kryptos has been partially
broken. In fact using such hosts "might" put you "more" at risk of
being monitored. That said, I won't deny there are ways to become
extremely anonymous to non-governmental agencies if one desires.

I have seen floppies that have been shredded, read, disks that have been
reformatted multiple times then platters broken, tickled apart. Yes,
erasing and rewriting the bits multiple times does obscure the data.

For those who believe simple SSL cannot be monitored, does not
understand how the protocol is negotiated and how it can be compromised
if one is in the middle of the communication stream.

I do not argue that the multiple erasure/write methodologies don't
"obscure" the information. But believing your wire is secure by going
through any host especially if the computer is in the hands of the
authorities is naive (for those who rely on private/public key or unique
key encryption). Ask some of those guys is the recent kiddie porn bust.
Several individuals had "heard" about the bust and worked very hard to
clean their systems, they just were not aware unlimited resources can do
much to recover the data. The individuals involved were already
"busted" from the wire data, they were just looking for others they were
in communication with before the authorities were monitoring. The trail
ended (might not be ended) when they busted the kiddie porn maker in
Australia.

One should not rely on the myth of anonymity. If I am reading your
browser cache that you have erased using standard methods, then I
already have enough access to your system to monitor just about anything
I want. While I might delete the browser cache, it is probably the last
thing I would worry about erasing/writing multiple times. If the person
who wants to know, has access to the system in question, all bets are
off as to what data may be recovered given enough interest and resources.

Winged

Posted by winged on December 12th, 2004


Max Mustermann wrote:
skewed. I will write annihilation 500 times in penance.

Winged

Posted by nemo outis on December 12th, 2004


In article <MPG.1c2561864d0ea1ad989c56@news-server.columbus.rr.com>, Leythos <void@nowhere.org> wrote:

Perhaps renting pornographic videos should not have ruined a
distinguished jurist's chance for the Supreme Court, but the fact
is it did. It was not a question of whether Bork was ashamed of
his actions, but of the behaviour of others.

Nor does one does not need much imagination to make the
technological shift from renting videos then to internet
behaviour now.

Regards,


PS Surf the net regarding, say, AIDS and wonder why -
mysteriously - you didn't get that great job you thought you had
in the bag?

It takes only minimal imagination - although some, however, lack
even that - to see how any number of benign and lawful internet
activities could come back to bite you on the ass. And, quite
possibly, without you ever knowing. An employer's check, for
instance.

Nor need the delelterious effects ne confined to you. That
youthful post you made for (or against) the Iraq war may be why
your son is not admitted to that exclusive boys school many years
later.

No, only utterly torpid sheeple have no need for privacy.


Posted by nemo outis on December 12th, 2004


In article <79Tud.491650$%k.464868@pd7tw2no>, nemo outis@erewhon.com (nemo outis) wrote:
...
Whoops, that'll teach me to finish editing before hitting the
send button.

Emend as follows:

Nor does one need much imagination to make the...

Regards,



Posted by nemo outis on December 12th, 2004


In article
<MPG.1c260ee592c638b2989c5d@news-server.columbus.rr.com>, Leythos
<void@nowhere.org> wrote:


Ashamed? Guilty? Thoughtless? Something to hide? Paranoid?

Is that what you bleat as the reasons someone would want privacy
or even anonymity? Is that what you think privacy is about?

I'm not going to waste a lot of time refuting misdirection,
denial and head-in-the sandism. I'll just give one example to
the contrary from US history (but the example could be drawn from
labour relations, love affairs, business dealings, family
matters, medical info, or a host of others)

Alexander Hamilton, John Jay, and James Madison published the
Federalist Papers anonymously as Publius. (And authorship was
not revealed for decades afterwards) Tell men like these the
Fourth Amendment is a mere bagatelle to be infringed at whim (in
the name of security or whatever other excuse is fashionable at
the moment).

Regards,

PS Nor is the need for privacy confined to grand issues.
There are folks who have lost civil court cases for personal
injury claims after the insurance company used grocery store
records regarding the amount of beer they bought to discredit
them.

Posted by nemo outis on December 12th, 2004


In article <Pt_ud.6665465$6p.1046847@news.easynews.com>, Bester@EAB5.com wrote:

Good points all. But the even more frightening possibility is
that, in Leythos' world, folks would be afraid to ever engage
in such behaviours in the first place. Truly, a nation of
sheeple would be the result.

Regards,

..

Posted by nemo outis on December 12th, 2004


In article <eotor0l37dg04pasdskd2lu3kffm8m3rh3@4ax.com>, Jim Watt
<jimwatt@aol.no_way> wrote:


Those "who have been working daily with computers for many years"
in commercial applications should understand that the **core
premise** of their occupation is that most data is PRIVATE and
access to it should be limited and controlled.

If there was no need for privacy there would be no need for
computer security.

Accordingly, privacy is not only on topic for
alt.computer.security, it addresses the core topic!

Regards,

PS Of course, computer security does tend to attract those
who take a "hall monitor" attitude towards controlling others'
behaviour. Not surprisingly, such folks, while eager to preserve
and protect their employers' private data, see no contradiction
in trying to deny privacy to others. Not hypocrisy in most cases,
just simple blindness and inability to reflect.


Posted by winged on December 12th, 2004


Jim Watt wrote:
Here is the address of one I just found trying to put a botnet on my
system :-P


CustName: Smartbot.NET, Inc.
Address: 3 Cobblestone Court
City: Richboro
StateProv: PA
PostalCode: 18954
Country: US
RegDate: 2003-08-14
Updated: 2003-08-14

NetRange: 216.22.46.192 - 216.22.46.223
CIDR: 216.22.46.192/27
NetName: SRVN
NetHandle: NET-216-22-46-192-1
Parent: NET-216-22-0-0-1
NetType: Reassigned
Comment: email:
RegDate: 2003-08-14
Updated: 2003-08-14

TechHandle: NO178-ARIN
TechName: Network Operations
TechPhone: +1-703-847-1421
TechEmail: noc@servint.com

OrgTechHandle: NO178-ARIN
OrgTechName: Network Operations
OrgTechPhone: +1-703-847-1421
OrgTechEmail: noc@servint.com

Go ahead and pump his sewers backwards, right up to the top of their
computer room. Of course, they probably would never notice, they are at
the top of my scum list at the moment. Came from a tech support site.
Is this the ARNG school Jim Watt?

Winged

Posted by nemo outis on December 12th, 2004


In article <4f9pr09if41llljbvf16sobf97apmd5ooc@4ax.com>, Jim Watt <jimwatt@aol.no_way> wrote:

You are only arguing WHY you want to keep private data secure,
not whether.

Regards,