Maiores informações (em inglês):
You can use up to five reader threads, 20 worker threads, one hashing thread and one writing thread during an acquisition
Windows Server 2008 R2 Support
EnCase now runs on Windows Server 2008 R2 64-bit with the following applications and modules:
- Examiner 32- and 64-bit
- ProSuite 32- and 64-bit, consisting of these modules:
- EnCase Decryption Suite (EDS)
- Virtual File System (VFS)
- Physical Disk Emulator (PDE)
- FastBloc SE
- Servlets 32- and 64-bit
EnCase Enterprise now provides the ability to snapshot and acquire across the network both PowerPC- and Intel-based Mac systems running Mac OS X, version 10.5 Leopard
WinAcq is a standalone multi-threaded command line utility that captures physical and logical acquisitions of specified devices. WinAcq is designed to run on a Windows operating system (Windows 2000 or higher) and allows you to specify the target device by volume letter or device number
Enhanced Physical Drive Preview
The previous condition limiting the number of physical devices that can be previewed to 30 has been removed.
Note: This enhancement applies only to Windows XP and higher. With earlier versions (for example, 9X and NT), the device limit is still 30.
LinEn Evidence Verification and Status Reporting
You can now verify evidence files and review the status of the verification using LinEn.
Updated Tableau Write Blocker tabphys.dll
EnCase supports the latest release of Tableau's tabphys.dll, which fixes sporadic crashes. The dll also now provides version information. The latest is 22.214.171.124.
Copy Selected Items from One Folder to Another
EnCase now provides the ability to copy selected items (for example, bookmarks or keywords) as a group from one folder to another. It is no longer necessary to copy the items one at a time