Contributors - CyberSecurity Malaysia

EnCase 101How EnCase Looks at the Time of theEvidence File? [Part 2]11.IntroductionIntroduction4. After Clicking “OK” (Figure 2), the NTRegistry willappear as shown in (Figure 3).In part one of this article, I had showed how EnCaseForensic Software shows the time of the evidence based onthe examiner’s machine time zone setting. So in part two, Iwill concentrate on how to find out the evidence time zonesetting and change the EnCase environment accordingly.DiscussionHow to know the evidence time zone setting? For evidencethat does not contain the operating system, such as a pendrive, the MAC(Modified, Access, Create) time will not beinfluenced by the time zone setting of the examiner’smachine.This means that EnCase Forensic Software willshow the exact MAC time of the files when it was beingcreated inside the media (in this case, a pen drive). If theevidence contains Operating System such as a primary harddisk found in a workstation, there are two ways basically tofind out about the time zone setting:• Manual (Registry directory)• Auto (run EnScript)a) Manual1. Load the hard disk image into EnCase ForensicSoftware.2. Navigate to C:\Windows\System32\Config. Select the“SYSTEM” file.3. Right click on the “SYSTEM” file and select view filestructure. (Figure1)Figure 2: Viewing the System registry hiveFigure 3: Windows NT Registry5. When open up NTRegistry\$$$PROTO.HIV, there are2 control sets. To know which control set is beingused by the user, click on the Select folder in theTree Pane and select “Current” in the Table Pane(Figure 4)Figure 4: Directory of Windows NT registryFigure 1: Locating and opening the Systemregistry hive6. Highlight the data in the View Pane and right click.Select Go To, and view the data in Little Endianformat (Figure 5 and 6). Ensure the value is 1 forother.e-Security | CyberSecurity Malaysia | Volume 21 - (Q4/2009)