Encase Logical Evidence Files (LEF) - Deletion Indication

[webel]

When creating Encase Logical Evidence files, metadata is kept in the newly created LEF from the original source forensic image.  Encase has an "Is Deleted" field that reports when a file is deleted.  Is there a way in Intella to display this "Is Deleted" column?  What about all other fields?  Intella seems to not be fully displaying all metadata fields.  This is a problem.

 

Thank you!

 

 

[AdamS]

I suspect this will have something to do with the way EnCase creates the LEF files, "Is Deleted" is not a normal meta data field, rather a flag that EnCase uses much the same way Xways uses "Previously Existing" to determine if a file has been carved or otherwise recovered somehow.

 

There is a wishlist section where you could request as a feature that Intella supports the ingestion of LEF files if you think this is something that would be of benefit.

 

Also you mention that there are other meta data fileds not being displayed....any specifics? What are you not seeing that you would expect to see?

[Chris]

Intella's focus is on the active data. We do not display this field at the moment. We may add this in a future version.

[ifinch001]

Any updates as to whether or not this will be in future versions? Or is it still a "maybe" type of feature?

[admin]

Any updates as to whether or not this will be in future versions? Or is it still a "maybe" type of feature?

 

It will be included. Hopefully within the next 2 versions.