EnCase v7 could not recognize Chinese character folder names / file names on Linux Platform

Last week my friend brought me an evidence file duplicated from a Linux server, which distribution is CentOS 5.0 and the i18n is zh-tw. She wanna know whether there is any malware on this Linux server or not. OK. Let‘s get to work. I add this evidence and do Evidence Process. Guess what??? EnCase could not  recognize Chinese character folder names / filenames, and those folder names / filenames become Hieroglyphics. I am very disappointed and don‘t know what to say to my friend... I guess I have to explain why EnCase may need night vision goggles when examining Linux platform evidence files. It‘s too ridiculous!

Needless to say, my friend also could not believe the #1 forensic tool - EnCase should have problems like that. Fortunately I still have another options like FTK or X-Ways Forensics to take over this case. You guys could take a look at screenshot below. I mount these evidence files by using FTK Imager Lite. You could see the Chinese character folder names / filenames now. I‘d like to remind you that FTK Imager Lite is a free tool...

时间： 2024-10-07 06:13:36

EnCase v7 could not recognize Chinese character folder names / file names on Linux Platform的相关文章

IEF could not decode Chinese character in IE history well

My friend is working on some case, and she looks not in the mood. I ask her what's going on. She wants me to look at the screenshot as below. That's why she is upset...IEF could not decode Chinese character in IE history well, so the filenames in Chi

EnCase v7 search hits in compound files?

I used to conduct raw search in EnCase v6, and I'd like to see if EnCase v7 raw search could hit keywords inside compound files or not. You won't believe it~search results is 0 but those keywords do exist inside compound files...Let my show you my te

[Powershell] Convert Chinese character to pinying

Found a new job in Beijing, the company was using cloud stuff for infrastructure IT systems, like mail system, mobile messaging, IM. The company is going bigger and stronger, making more money, so the bosses decided update to AD/exchange/lync. It is

csharp: Converting chinese character to Unicode

Function chinese2unicode(Str) Dim Str_one:Str_one = "" Dim Str_unicode:Str_unicode = "" For i = 1 To Len(Str) Str_one = Mid(Str, i, 1) If AscW(Str_one) < 0 or AscW(Str_one) > 255 Then Str_unicode = Str_unicode & Chr(38) Str_u

Fix Some bytes have been replaced with the Unicode substitution character while loading file XXX.cs with Chinese Simplified (GB2312) encoding

When we use <strong>visual studio</strong> open source file or any other file, we may encounter below problem:   <strong>File Load</strong> <strong>Some bytes have been replaced with the Unicode substitution character while l

Fix Some bytes have been replaced with the Unicode substitution character while loading file XXX.cs

When we use <strong>visual studio</strong> open source file or any other file, we may encounter below problem:   <strong>File Load</strong> <strong>Some bytes have been replaced with the Unicode substitution character while l

【Python】SyntaxError: Non-ASCII character &#39;\xe8&#39; in file

遇到的第一个问题: SyntaxError: Non-ASCII character '\xe8' in file D:/PyCharmProject/TempConvert.py on line 2, but no encoding declared; see http://python.org/dev/peps/pep-0263/ for details 原因:注释里面出现了中文,而 Python 支持的 ASCII 码无中文. 解决方法:在头文件中添加如下代码: # -*- coding:

SyntaxError: Non-ASCII character &#39;\xe7&#39; in file

错误提示: SyntaxError: Non-ASCII character '\xe7' in file 出现这种错误的原因是程序中的编码出问题了,只要在程序的最前面加上 出现这种错误的原因是程序中的编码出现了问题,只要在程序的最前面添加,一定要是最前面哦 #_*_coding: UTF-8 _*_ SyntaxError: Non-ASCII character '\xe7' in file

Non-ASCII character &#39;\xe8&#39; in file xxx.py on line 8, but no encoding declared

使用网上某个python程序,编译时报错: File "xxx.py", line 8         SyntaxError: Non-ASCII character '\xe8' in file xxx.py on line 8, but no encoding declared; see http://www.python.org/peps/pep-0263.html for details 原因是缺少编码类型声明:no encoding declared 段首添加一行声明即可: