Which filesystem is hosting the relevant files? HFS+? Journaled HFS+?
EnCase 6 has issues viewing some versions of HFS, but I am somewhat surprised (although I guess I shouldn't be) about EnCase 7 parsing it incorrectly. Personally I would post something about this on the GSI forums.
If using a Mac for investigations is not a possibility for you (or you want something cheaper), X-Ways parses HFS+ OK in all it's flavours as far as I know.
↧