Jump to content

Encase Logical Evidence Files (LEF) - Deletion Indication


Recommended Posts

When creating Encase Logical Evidence files, metadata is kept in the newly created LEF from the original source forensic image.  Encase has an "Is Deleted" field that reports when a file is deleted.  Is there a way in Intella to display this "Is Deleted" column?  What about all other fields?  Intella seems to not be fully displaying all metadata fields.  This is a problem.


Thank you!



Link to comment
Share on other sites

I suspect this will have something to do with the way EnCase creates the LEF files, "Is Deleted" is not a normal meta data field, rather a flag that EnCase uses much the same way Xways uses "Previously Existing" to determine if a file has been carved or otherwise recovered somehow.


There is a wishlist section where you could request as a feature that Intella supports the ingestion of LEF files if you think this is something that would be of benefit.


Also you mention that there are other meta data fileds not being displayed....any specifics? What are you not seeing that you would expect to see?

Link to comment
Share on other sites

  • 11 months later...

Join the conversation

You can post now and register later. If you have an account, sign in now to post with your account.

Reply to this topic...

×   Pasted as rich text.   Paste as plain text instead

  Only 75 emoji are allowed.

×   Your link has been automatically embedded.   Display as a link instead

×   Your previous content has been restored.   Clear editor

×   You cannot paste images directly. Upload or insert images from URL.


  • Create New...