Saturday, March 15, 2014

EnCase refresher

A week ago small EnCase refresh was done for some of our clients.  Since EnCase has plenty of sub-releases in one year it is wise to do leveling and new features discussion. The key new concept which was added since last meeting is distributed processing and remote preview without safe. Also plenty of other changes in interface, tagging, file attributes tab, conditions etc. There were also some hardware issues about machine configurations, adding disks, memory, processor dongle issues.

Many things to go trough in two days, it was interesting we do a bit of pizza party too.

We have plenty of talk about conditions and conditions usage, especially strategy of creating and using conditions. We were shoving methods and how to combine and reuse condition among cases and among members of the team.  Naming conventions, commenting, internal filters .. a lot of things to talk about
I've put some thought on attribute conditions before on this blog.
Basically there are two methods one when you use simple conditions and use it recursively on results of previous conditions or when you write  a big monolithic condition in advance.
There was discussion what is better and why, what is faster, how to organise attributes in conditions
a lot of theory.







  

No comments:

Post a Comment