SlideShare a Scribd company logo
1 of 16
100110011111 
1100110011111001 
11110010101011111 
01001100110010011 
1100100111001110 
111100110110 
RAC Digital Forensics InfoDay 2014 vol. II 
EnCASE EnSCRIPT 
Marián Svetlík jr. 
Erpet Golf Centrum Praha 
19. 11. 2014
100110011111 
1100110011111001 
11110010101011111 
01001100110010011 
1100100111001110 
111100110110 
BEST PRACTICES 
• skriptovací jazyk 
• velmi podobný C++ a Javě 
• jeden z nástrojů automatizace činností v EnCase 
3. 12. 2014 RAC Digital Forensics InfoDay 2014 vol. II 2 
Co je to EnScript?
100110011111 
1100110011111001 
11110010101011111 
01001100110010011 
1100100111001110 
111100110110 
BEST PRACTICES 
• skriptovací jazyk 
• velmi podobný C++ a Javě 
• jeden z nástrojů automatizace činností v EnCase 
3. 12. 2014 RAC Digital Forensics InfoDay 2014 vol. II 3 
Co je to EnScript?
100110011111 
1100110011111001 
11110010101011111 
01001100110010011 
1100100111001110 
111100110110 
BEST PRACTICES 
EnScript x Conditions & Filters 
3. 12. 2014 RAC Digital Forensics InfoDay 2014 vol. II 4 
• Condition 
• Filter 
• EnScript 
znalost EnScript
100110011111 
1100110011111001 
11110010101011111 
01001100110010011 
1100100111001110 
111100110110 
BEST PRACTICES 
Co dokáže EnScript? 
• má přístup ke všemu, co uživatel vidí v rámci EnCase 
• dokáže vytvářet adresáře a soubory na lokálním či vzdáleném systému nebo je mazat 
• dokáže spouštět jiné procesy 
3. 12. 2014 RAC Digital Forensics InfoDay 2014 vol. II 5
100110011111 
1100110011111001 
11110010101011111 
01001100110010011 
1100100111001110 
111100110110 
BEST PRACTICES 
3. 12. 2014 RAC Digital Forensics InfoDay 2014 vol. II 6 
Jak začít?
100110011111 
1100110011111001 
11110010101011111 
01001100110010011 
1100100111001110 
111100110110 
BEST PRACTICES 
3. 12. 2014 RAC Digital Forensics InfoDay 2014 vol. II 7 
Jak začít?
100110011111 
1100110011111001 
11110010101011111 
01001100110010011 
1100100111001110 
111100110110 
BEST PRACTICES 
3. 12. 2014 RAC Digital Forensics InfoDay 2014 vol. II 8 
Jak začít?
100110011111 
1100110011111001 
11110010101011111 
01001100110010011 
1100100111001110 
111100110110 
BEST PRACTICES 
3. 12. 2014 RAC Digital Forensics InfoDay 2014 vol. II 9 
Jak začít?
100110011111 
1100110011111001 
11110010101011111 
01001100110010011 
1100100111001110 
111100110110 
BEST PRACTICES 
3. 12. 2014 RAC Digital Forensics InfoDay 2014 vol. II 10 
Jak začít?
100110011111 
1100110011111001 
11110010101011111 
01001100110010011 
1100100111001110 
111100110110 
BEST PRACTICES 
Něco hotového do začátku 
3. 12. 2014 RAC Digital Forensics InfoDay 2014 vol. II 11
100110011111 
1100110011111001 
11110010101011111 
01001100110010011 
1100100111001110 
111100110110 
BEST PRACTICES 
Něco hotového do začátku 
3. 12. 2014 RAC Digital Forensics InfoDay 2014 vol. II 12
100110011111 
1100110011111001 
11110010101011111 
01001100110010011 
1100100111001110 
111100110110 
BEST PRACTICES 
Něco hotového do začátku 
3. 12. 2014 RAC Digital Forensics InfoDay 2014 vol. II 13
100110011111 
1100110011111001 
11110010101011111 
01001100110010011 
1100100111001110 
111100110110 
BEST PRACTICES 
Něco hotového do začátku 
3. 12. 2014 RAC Digital Forensics InfoDay 2014 vol. II 14
100110011111 
1100110011111001 
11110010101011111 
01001100110010011 
1100100111001110 
111100110110 
BEST PRACTICES 
Něco hotového do začátku 
3. 12. 2014 RAC Digital Forensics InfoDay 2014 vol. II 15
100110011111 
1100110011111001 
11110010101011111 
01001100110010011 
1100100111001110 
111100110110 
BEST PRACTICES 
3. 12. 2014 RAC Digital Forensics InfoDay 2014 vol. II 16 
Otázky? 
Děkuji za pozornost!

More Related Content

Viewers also liked

Securing your IT infrastructure with SOC-NOC collaboration TWP
Securing your IT infrastructure with SOC-NOC collaboration TWPSecuring your IT infrastructure with SOC-NOC collaboration TWP
Securing your IT infrastructure with SOC-NOC collaboration TWPSridhar Karnam
 
Can Security & Agility Co-Exist
Can Security & Agility Co-ExistCan Security & Agility Co-Exist
Can Security & Agility Co-ExistScott Carlson
 
Protecting your data against cyber attacks in big data environments
Protecting your data against cyber attacks in big data environmentsProtecting your data against cyber attacks in big data environments
Protecting your data against cyber attacks in big data environmentsat MicroFocus Italy ❖✔
 
RSA 2016 Realities of Data Security
RSA 2016 Realities of Data SecurityRSA 2016 Realities of Data Security
RSA 2016 Realities of Data SecurityScott Carlson
 
Managing risk and vulnerabilities in a business context
Managing risk and vulnerabilities in a business contextManaging risk and vulnerabilities in a business context
Managing risk and vulnerabilities in a business contextAlgoSec
 
Big Data Security Analytics (BDSA) with Randy Franklin
Big Data Security Analytics (BDSA) with Randy FranklinBig Data Security Analytics (BDSA) with Randy Franklin
Big Data Security Analytics (BDSA) with Randy FranklinSridhar Karnam
 
AWS Security Fundamentals: Dos and Don’ts
AWS Security Fundamentals: Dos and Don’tsAWS Security Fundamentals: Dos and Don’ts
AWS Security Fundamentals: Dos and Don’tsAlgoSec
 
Trust But Control: Managing Privileges without killing productivity
Trust But Control:  Managing Privileges without killing productivityTrust But Control:  Managing Privileges without killing productivity
Trust But Control: Managing Privileges without killing productivityScott Carlson
 
The State of Network Security 2014
The State of Network Security 2014The State of Network Security 2014
The State of Network Security 2014AlgoSec
 
Will Your Cloud Be Compliant? OpenStack Security
Will Your Cloud Be Compliant?  OpenStack SecurityWill Your Cloud Be Compliant?  OpenStack Security
Will Your Cloud Be Compliant? OpenStack SecurityScott Carlson
 
Avoid outages-from-misconfigured-devices-webinar-slides
Avoid outages-from-misconfigured-devices-webinar-slidesAvoid outages-from-misconfigured-devices-webinar-slides
Avoid outages-from-misconfigured-devices-webinar-slidesAlgoSec
 
Security is from Mars, Application Delivery is from Venus
Security is from Mars, Application Delivery is from VenusSecurity is from Mars, Application Delivery is from Venus
Security is from Mars, Application Delivery is from VenusAlgoSec
 
Dos and Don’ts for Managing External Connectivity to/from Your Network
Dos and Don’ts for Managing External Connectivity to/from Your NetworkDos and Don’ts for Managing External Connectivity to/from Your Network
Dos and Don’ts for Managing External Connectivity to/from Your NetworkAlgoSec
 
Reaching PCI Nirvana: Ensure a Successful Audit & Maintain Continuous Compliance
Reaching PCI Nirvana: Ensure a Successful Audit & Maintain Continuous ComplianceReaching PCI Nirvana: Ensure a Successful Audit & Maintain Continuous Compliance
Reaching PCI Nirvana: Ensure a Successful Audit & Maintain Continuous ComplianceAlgoSec
 
A Pragmatic Approach to Network Security Across Your Hybrid Cloud Environment
A Pragmatic Approach to Network Security Across Your Hybrid Cloud EnvironmentA Pragmatic Approach to Network Security Across Your Hybrid Cloud Environment
A Pragmatic Approach to Network Security Across Your Hybrid Cloud EnvironmentAlgoSec
 

Viewers also liked (20)

Securing your IT infrastructure with SOC-NOC collaboration TWP
Securing your IT infrastructure with SOC-NOC collaboration TWPSecuring your IT infrastructure with SOC-NOC collaboration TWP
Securing your IT infrastructure with SOC-NOC collaboration TWP
 
Volume2 chapter1 security
Volume2 chapter1 securityVolume2 chapter1 security
Volume2 chapter1 security
 
Can Security & Agility Co-Exist
Can Security & Agility Co-ExistCan Security & Agility Co-Exist
Can Security & Agility Co-Exist
 
Protecting your data against cyber attacks in big data environments
Protecting your data against cyber attacks in big data environmentsProtecting your data against cyber attacks in big data environments
Protecting your data against cyber attacks in big data environments
 
Test
TestTest
Test
 
RSA 2016 Realities of Data Security
RSA 2016 Realities of Data SecurityRSA 2016 Realities of Data Security
RSA 2016 Realities of Data Security
 
Managing risk and vulnerabilities in a business context
Managing risk and vulnerabilities in a business contextManaging risk and vulnerabilities in a business context
Managing risk and vulnerabilities in a business context
 
Big Data Security Analytics (BDSA) with Randy Franklin
Big Data Security Analytics (BDSA) with Randy FranklinBig Data Security Analytics (BDSA) with Randy Franklin
Big Data Security Analytics (BDSA) with Randy Franklin
 
AWS Security Fundamentals: Dos and Don’ts
AWS Security Fundamentals: Dos and Don’tsAWS Security Fundamentals: Dos and Don’ts
AWS Security Fundamentals: Dos and Don’ts
 
Final review
Final reviewFinal review
Final review
 
Trust But Control: Managing Privileges without killing productivity
Trust But Control:  Managing Privileges without killing productivityTrust But Control:  Managing Privileges without killing productivity
Trust But Control: Managing Privileges without killing productivity
 
The State of Network Security 2014
The State of Network Security 2014The State of Network Security 2014
The State of Network Security 2014
 
Will Your Cloud Be Compliant? OpenStack Security
Will Your Cloud Be Compliant?  OpenStack SecurityWill Your Cloud Be Compliant?  OpenStack Security
Will Your Cloud Be Compliant? OpenStack Security
 
Avoid outages-from-misconfigured-devices-webinar-slides
Avoid outages-from-misconfigured-devices-webinar-slidesAvoid outages-from-misconfigured-devices-webinar-slides
Avoid outages-from-misconfigured-devices-webinar-slides
 
Security is from Mars, Application Delivery is from Venus
Security is from Mars, Application Delivery is from VenusSecurity is from Mars, Application Delivery is from Venus
Security is from Mars, Application Delivery is from Venus
 
Dos and Don’ts for Managing External Connectivity to/from Your Network
Dos and Don’ts for Managing External Connectivity to/from Your NetworkDos and Don’ts for Managing External Connectivity to/from Your Network
Dos and Don’ts for Managing External Connectivity to/from Your Network
 
optical illusions
optical illusionsoptical illusions
optical illusions
 
Reaching PCI Nirvana: Ensure a Successful Audit & Maintain Continuous Compliance
Reaching PCI Nirvana: Ensure a Successful Audit & Maintain Continuous ComplianceReaching PCI Nirvana: Ensure a Successful Audit & Maintain Continuous Compliance
Reaching PCI Nirvana: Ensure a Successful Audit & Maintain Continuous Compliance
 
A Pragmatic Approach to Network Security Across Your Hybrid Cloud Environment
A Pragmatic Approach to Network Security Across Your Hybrid Cloud EnvironmentA Pragmatic Approach to Network Security Across Your Hybrid Cloud Environment
A Pragmatic Approach to Network Security Across Your Hybrid Cloud Environment
 
Shadow IT
Shadow ITShadow IT
Shadow IT
 

More from Risk Analysis Consultants, s.r.o.

QualysGuard InfoDay 2014 - QualysGuard Web Application Security a Web Applica...
QualysGuard InfoDay 2014 - QualysGuard Web Application Security a Web Applica...QualysGuard InfoDay 2014 - QualysGuard Web Application Security a Web Applica...
QualysGuard InfoDay 2014 - QualysGuard Web Application Security a Web Applica...Risk Analysis Consultants, s.r.o.
 
QualysGuard InfoDay 2014 - QualysGuard Continuous Monitoring
QualysGuard InfoDay 2014 - QualysGuard Continuous MonitoringQualysGuard InfoDay 2014 - QualysGuard Continuous Monitoring
QualysGuard InfoDay 2014 - QualysGuard Continuous MonitoringRisk Analysis Consultants, s.r.o.
 
QualysGuard InfoDay 2013 - Případová studie ČNB - QG WAS
QualysGuard InfoDay 2013 - Případová studie ČNB - QG WASQualysGuard InfoDay 2013 - Případová studie ČNB - QG WAS
QualysGuard InfoDay 2013 - Případová studie ČNB - QG WASRisk Analysis Consultants, s.r.o.
 
QualysGuard InfoDay 2013 - QualysGuard RoadMap for H2-­2013/H1-­2014
QualysGuard InfoDay 2013 - QualysGuard RoadMap for H2-­2013/H1-­2014QualysGuard InfoDay 2013 - QualysGuard RoadMap for H2-­2013/H1-­2014
QualysGuard InfoDay 2013 - QualysGuard RoadMap for H2-­2013/H1-­2014Risk Analysis Consultants, s.r.o.
 
QualysGuard InfoDay 2013 - QualysGuard Security & Compliance Suite supporting...
QualysGuard InfoDay 2013 - QualysGuard Security & Compliance Suite supporting...QualysGuard InfoDay 2013 - QualysGuard Security & Compliance Suite supporting...
QualysGuard InfoDay 2013 - QualysGuard Security & Compliance Suite supporting...Risk Analysis Consultants, s.r.o.
 
QualysGuard InfoDay 2012 - Malware Detection Service – Enterprise Edition
QualysGuard InfoDay 2012 - Malware Detection Service – Enterprise EditionQualysGuard InfoDay 2012 - Malware Detection Service – Enterprise Edition
QualysGuard InfoDay 2012 - Malware Detection Service – Enterprise EditionRisk Analysis Consultants, s.r.o.
 

More from Risk Analysis Consultants, s.r.o. (20)

Best practice v testování zranitelností
Best practice v testování zranitelnostíBest practice v testování zranitelností
Best practice v testování zranitelností
 
QualysGuard InfoDay 2014 - QualysGuard Web Application Security a Web Applica...
QualysGuard InfoDay 2014 - QualysGuard Web Application Security a Web Applica...QualysGuard InfoDay 2014 - QualysGuard Web Application Security a Web Applica...
QualysGuard InfoDay 2014 - QualysGuard Web Application Security a Web Applica...
 
QualysGuard InfoDay 2014 - QualysGuard Continuous Monitoring
QualysGuard InfoDay 2014 - QualysGuard Continuous MonitoringQualysGuard InfoDay 2014 - QualysGuard Continuous Monitoring
QualysGuard InfoDay 2014 - QualysGuard Continuous Monitoring
 
QualysGuard InfoDay 2014 - Asset management
QualysGuard InfoDay 2014  - Asset managementQualysGuard InfoDay 2014  - Asset management
QualysGuard InfoDay 2014 - Asset management
 
QualysGuard InfoDay 2014 - WAS
QualysGuard InfoDay 2014 - WASQualysGuard InfoDay 2014 - WAS
QualysGuard InfoDay 2014 - WAS
 
QualysGuard InfoDay 2014 - Policy compliance
QualysGuard InfoDay 2014 - Policy complianceQualysGuard InfoDay 2014 - Policy compliance
QualysGuard InfoDay 2014 - Policy compliance
 
QualysGuard InfoDay 2014 - Vulnerability management
QualysGuard InfoDay 2014 - Vulnerability managementQualysGuard InfoDay 2014 - Vulnerability management
QualysGuard InfoDay 2014 - Vulnerability management
 
Použití hashsetů v EnCase Forensic v7
Použití hashsetů v EnCase Forensic v7Použití hashsetů v EnCase Forensic v7
Použití hashsetů v EnCase Forensic v7
 
Analýza elektronické pošty v EnCase Forensic v7
Analýza elektronické pošty v EnCase Forensic v7Analýza elektronické pošty v EnCase Forensic v7
Analýza elektronické pošty v EnCase Forensic v7
 
Vybrané funkce Forensic Toolkit 5 + RAC Forensic Imager
Vybrané funkce Forensic Toolkit 5 + RAC Forensic ImagerVybrané funkce Forensic Toolkit 5 + RAC Forensic Imager
Vybrané funkce Forensic Toolkit 5 + RAC Forensic Imager
 
QualysGuard InfoDay 2013 - Případová studie ČNB - QG WAS
QualysGuard InfoDay 2013 - Případová studie ČNB - QG WASQualysGuard InfoDay 2013 - Případová studie ČNB - QG WAS
QualysGuard InfoDay 2013 - Případová studie ČNB - QG WAS
 
QualysGuard InfoDay 2013 - Qualys Questionnaire
QualysGuard InfoDay 2013 - Qualys QuestionnaireQualysGuard InfoDay 2013 - Qualys Questionnaire
QualysGuard InfoDay 2013 - Qualys Questionnaire
 
QualysGuard InfoDay 2013 - Nové funkce QG
QualysGuard InfoDay 2013 - Nové funkce QGQualysGuard InfoDay 2013 - Nové funkce QG
QualysGuard InfoDay 2013 - Nové funkce QG
 
QualysGuard InfoDay 2013 - Web Application Firewall
QualysGuard InfoDay 2013 - Web Application FirewallQualysGuard InfoDay 2013 - Web Application Firewall
QualysGuard InfoDay 2013 - Web Application Firewall
 
QualysGuard InfoDay 2013 - QualysGuard RoadMap for H2-­2013/H1-­2014
QualysGuard InfoDay 2013 - QualysGuard RoadMap for H2-­2013/H1-­2014QualysGuard InfoDay 2013 - QualysGuard RoadMap for H2-­2013/H1-­2014
QualysGuard InfoDay 2013 - QualysGuard RoadMap for H2-­2013/H1-­2014
 
QualysGuard InfoDay 2013 - QualysGuard Security & Compliance Suite supporting...
QualysGuard InfoDay 2013 - QualysGuard Security & Compliance Suite supporting...QualysGuard InfoDay 2013 - QualysGuard Security & Compliance Suite supporting...
QualysGuard InfoDay 2013 - QualysGuard Security & Compliance Suite supporting...
 
QualysGuard InfoDay 2013 - Asset Management
QualysGuard InfoDay 2013 - Asset ManagementQualysGuard InfoDay 2013 - Asset Management
QualysGuard InfoDay 2013 - Asset Management
 
QualysGuard InfoDay 2012 - Secure Digital Vault for Qualys
QualysGuard InfoDay 2012 - Secure Digital Vault for QualysQualysGuard InfoDay 2012 - Secure Digital Vault for Qualys
QualysGuard InfoDay 2012 - Secure Digital Vault for Qualys
 
QualysGuard InfoDay 2012 - BrowserCheck
QualysGuard InfoDay 2012 - BrowserCheckQualysGuard InfoDay 2012 - BrowserCheck
QualysGuard InfoDay 2012 - BrowserCheck
 
QualysGuard InfoDay 2012 - Malware Detection Service – Enterprise Edition
QualysGuard InfoDay 2012 - Malware Detection Service – Enterprise EditionQualysGuard InfoDay 2012 - Malware Detection Service – Enterprise Edition
QualysGuard InfoDay 2012 - Malware Detection Service – Enterprise Edition
 

Použití EnCase EnScript