EnCase

Beat EnCase File Signature Analysis on a Windows System

By Max on September 13, 2009

Use a hex editor to modify the file signature of a WinRAR archive to that of an executable file to beat the EnCase forensic software’s file signature analysis.

Posted in EnCase, Hex Editing | Tagged EnCase, file signature analysis, hex editing, hex editor, timestomp, winrar | 8 Responses

Modify TrueCrypt Encryption Boot Loader Strings (16)
- sub: If an expert hacker access my drive whether in person or over the net,...
How to Delete Google History – Clear Google Toolbar History (5)
- Sailesh Thaosen: I would like to ask you to deleat my all google history...
Full Disk Encryption With TrueCrypt on Windows XP (4)
- Jessica: TrueCrypt is especially nice being that it was redesigned and...
Leave No Artifacts Behind – Linux Live CDs (6)
- Olivia Graves: by the way, this Windows boot CD is easy to use and works
Saudi Arabia Bans BlackBerry’s (8)
- Alex Dimitrov: “HOL Y FUCK SHUT UP DON’T YOU BITCHES TALK ABOUT ANYTH...
- rabbit: I hate to ever defend Apple but I don’ t think the iPhone...
- HaPa: I would DIE without my blackberry . I’m an addict.
The Rootkit Arsenal: Escape and Evasion in the Dark Corners of the System by Bill Blunden (3)
- Jeff: Thanks for the link and the book review. It looks very interestin g and...

EnCase

Beat EnCase File Signature Analysis on a Windows System

Subscribe to Anti-Forensics

Links

Recent Comments

Tags

Archives

Writers

Site Pages

Site Links

Anti-Forensics