April 09, 2009

Great process indicator for Encase

Anybody who's working with Encase knows it's process indicator isn't accurate. You never know how long a process (acquire, verify etc.) wil take. The free Process Monitor of systinternals.com solves this problem.

How does it work

Download the free tool, unzip it and store procmon.exe in the c:\Windows\sytem32 folder

Next time you start to work with Encase, open a dosbox and type "procmon.exe". Process Monitor will now start.

Procmon1

Now add the following details:

Process name is Encase.exe then Include

Procmon2   

Click Add and OK

Now, you can exactly see the processes of Encase.

Apr 9, 2009 1:11:52 PM | Forensics

The comments to this entry are closed.

NEXT POST
Finding strings in unallocated clusters with Windows tool As I wrote earlier, I'm working on a new forensic tool (maybe I better call it toolkit). Today I did a test to find information in the unallocated clusters of a live Windows pc. My toolkit seems to work fine...
PREVIOUS POST
How to change security settings for XAMPP localhost The standard settings for XAMPP MySQL are without a root password. You can set a password for the root account here: http://localhost/security/xamppsecurity.php Afterwards, you can check it here: http://localhost/security/

Mark

The Typepad Team

Search

My Other Accounts

Recent Comments