EnCase v.s. FTK - find out Chinese characters writing in different direction
2015-09-07 22:51
393 查看
A friend of mine said to me that she could fool those forensic tools easily by changing writing direction in text. I said to her: "Really? Are you sure...don't jump to conclusions too soon...". She showed me two screenshots as below:
1.She used Intella to do full index search:
2. She searched "烈日" and "臺北賓館", and those characters definitely exist in above file, guess what? no any hits found...
Ok Intella failed to find those Chinese characters that actually exist. Let's try EnCase and FTK. First we use EnCase to search "bomb". Unfortunately EnCase only got 1 hit...Acutally there is more than 1 "bomb" in it.
Next we search "烈日", and EnCase find 1 hit. So EnCase is clever enough to find out those Chinese characters in vertical direction.
How about FTK? Let's search "c4", and FTK could find it out without fail.
Then we search "烈日". FTK sucessfully hits "烈日" exactly as EnCase does.
Suspect may use such tricks to try to fool forensic tools. Fortunately EnCase and FTK could search and hit those Chinese characters in vertical direction. Now she realizes why those forensic tools cost lots of money.
1.She used Intella to do full index search:
2. She searched "烈日" and "臺北賓館", and those characters definitely exist in above file, guess what? no any hits found...
Ok Intella failed to find those Chinese characters that actually exist. Let's try EnCase and FTK. First we use EnCase to search "bomb". Unfortunately EnCase only got 1 hit...Acutally there is more than 1 "bomb" in it.
Next we search "烈日", and EnCase find 1 hit. So EnCase is clever enough to find out those Chinese characters in vertical direction.
How about FTK? Let's search "c4", and FTK could find it out without fail.
Then we search "烈日". FTK sucessfully hits "烈日" exactly as EnCase does.
Suspect may use such tricks to try to fool forensic tools. Fortunately EnCase and FTK could search and hit those Chinese characters in vertical direction. Now she realizes why those forensic tools cost lots of money.
相关文章推荐
- react-native试玩(11)-模态
- js整理2
- 简单的jquery tab
- JS 面向对象随笔
- JSON
- JavaScript之prototype
- js事件知识回顾
- JavaScript之对象的遍历
- 剑指offer:斐波那契数列
- HTML编写需要注意的事项
- Javascript邮箱增删
- javascript输入验证
- [前端] canvas进阶之图片缩放、水印及放大镜
- 【h5-egret】js加载成第三方库
- css定位浮动 &html 严格模式混杂模式
- 实现一个类似jquery选择器的小轮子(二)
- 一个简单div+css来练习
- 利用js实现简单计算器
- 剑指Offer系列---(7)从尾到头打印链表
- 让label中的不同字符显示不同的样式