mitch wrote:
I have a monster of a PC however, silly things like I use 4 monitors and last I heard was you cant split the screens.
Processing is a issue, but i think will always be one, and will grow.......
As far as I know, you could always split the windows in EnCase 7. I only use two monitors though, so I have the View pane split from the Tree and Table panes. Could 6 be split further than that?
By "monster" PC, what do you mean? Anything like the specs in my previous post? My computers are nothing like that. i7-2600K, 32GB, SSD for OS, SATA for evidence files, RAID 5 of spinning disks for evidence cache. I need to switch the RAID 5 to 0, but I don't have a good backup system in place yet, so I don't want to go with 0.
As for your last question--a little background is in order. I started in digital forensics about three years ago. I did my EnCE exam on EnCase 6, but at that time, EnCase 7 was out and it was very clear GSI wasn't going to keep developing 6 with new features slated for 7. I made the choice to stop learning 6 and move to 7. I still jump back to 6 to verify some things, but when I do, I have to look back to my training materials, prep book, or the forums on how to do things in 6.
So, that said, if 6 is second nature to you, you very well may want to tear your hair out if you go to 7. The interface, work flow, techniques, and even core features are all very different. I would recommend the latest edition of the EnCE prep book. It covers 7, and there are several things in the book that you won't find in the documentation or the, frankly inadequate, EnCase Essentials web cast GSI offers for free. The author even covers those switching from 6 to 7 because to write the book, he had to make that switch.
7 is the future of EnCase, like it or not. I think the problems with 7 have driven many people to X-Ways or FTK as the primary tool, but 7 has gotten better. Still needs work though, lots of work.
As an aside--the most telling thing is if you follow the link to the thread at GSI in my post above, you'll notice that no GSI employee has chimed in to offer any explanation. This is what I find most frustrating. GSI claims that performance has improved in 7.0x all the time, but with every new release, you get questions like that one and it's clear that processing times are nowhere near what they should be. After two years, they should have this sorted out. When they are called out on the problem, they simply ignore it on their forums.
↧