Searching and GREP Webinar with Guidance Software

If you've looked at GREP but found it too cryptic to want to tackle learning it, this is the webinar for you.  I walk you through the GREP implementation in EnCase and explain the commands one by one.  We build GREP expressions from simple to complex, adding as we go along to account for the use cases.  Using the keyword tester and a datafile with positive and negative examples of the data we might want to find, we can verify that our GREP expressions are working as planned before we use them on case data.  


You can download the sample chapter from the Book Files section of this site, which covers GREP in more detail, and also the other searching features available to you in EnCase.  You can also download the two GREP data files and a file with the GREP expressions I use in the chapter and the webinar.

Forensics Readiness Webinar with Guidance Software

On June 18th, I was featured in a webinar with Guidance Software on Forensic Readiness: Preparing to Conduct an Internal Investigation.  The webinar was recorded and you can catch it on the Guidance Software website if you missed the event.  This is the first of a two part series with Guidance Software.  The second webinar will be on July 23, 2014, and the topic will be Searching and GREP, and feature a portion of the sample chapter for the book. 

I mentioned that you can get the files I use in the book (and the webinars) in the Book Files section of this website.  I include a second grep datafile in the webinar that was not used in the book, which you can also download. 

Forensic Lunch Appearance

You may be familiar with the Hacking Exposed Computer Forensics Blog run by David Cowen.  If you aren't, I highly recommend it as a source of good information on computer forensic topics.  David runs a weekly Google Hangout called the Forensic Lunch where he invites guests to discuss topics of interest.  Today, he did a live chat, and I joined him for that along with Lee Whitfield.  It was fun, and I recommend if you have something to chat about, you consider going on his show.

Welcome Readers!

The book is with the printer, and I'm just getting the website set up for this and my future books on EnCase. I hope you find the book helpful.  My goal was to write the book I would have liked to purchase when I got started working with EnCase.  The software is so complex and robust that it was beyond the scope of the book to address every use case, and there were areas where I really wish I could have expanded into.  Over time, I hope to address some of these topics on this site, and if there are specific things you'd like to see, please let me know.