James Habben The EnCase® Evidence Processor has some great features, but did you know that it can also parse Internet history and bookmarks from a USB thumb drive? Today we will look at forensic artifacts from the use of Mozilla Firefox and Google Chrome web browsers used from the PortableApps.com framework. First, let’s have a quick intro on the framework. The project was originally created to make a version of Firefox that was able to run solely from a USB thumb drive. It required a computer that was running Windows®, but it did not need Firefox.

The thumb drive carried the application and stored all the history, bookmarks, and settings back onto the thumb drive. This setup allows privacy, secrecy, and convenience. Today, the PortableApps.com framework allows for a ton more applications to be run in a portable configuration. To use the framework, you simply download the installer from the PortableApps.com website.

Run the installer and point it to your thumb drive. This installs the framework, but no applications. Here is what the application launcher looks like. Guidance Software During the v7 roadshow last year one of the most talked about new features was our. The question I heard over and over was 'Can I buy Passware from Guidance Software?' At the time unfortunately you could not but I am glad to say that now you can.

Before getting into how you can purchase the product, let's talk a little about our integration and what exactly you can do with Passware Kit Forensic. With EnCase® Forensic v7 you can perform protected file analysis in the evidence processor. Stephen Jay Gould Panda Thumb Pdf Editor more. Using Passware's Encryption Analyzer, EnCase will identify encrypted and password-protected files. Once protected file analysis is complete, you will be able to see what files are protected as well as the complexity of the protection, pretty cool stuff. To do what I have briefly described you do not need a license for Passware, this capability is part of v7, no strings attached.