Search the Community
Showing results for tags 'Encase Logical Evidence Files'.
When creating Encase Logical Evidence files, metadata is kept in the newly created LEF from the original source forensic image. Encase has an "Is Deleted" field that reports when a file is deleted. Is there a way in Intella to display this "Is Deleted" column? What about all other fields? Intella seems to not be fully displaying all metadata fields. This is a problem. Thank you!