Filters
The Filters panel is where the examiner can quickly and easily create and edit filters. When a filter is activated, only the files that fit the filter criteria, such as “Pictures only” or “Files Accessed After February, 2003 only” are displayed.
Queries
The Queries panel combines the functionality of filters together, creating customized, powerful queries that drastically reduce the time taken to navigate files. For example, to view only log files, mail files, and all DOC, TXT, WP, and HTML files, use the Compound Filter Query to combine the separate filters into one complex query.
Navigation explained ITEM
DESCRIPTION
“All Files”
The “All Files” button, the “home-plate” shaped trigger next to the check box with each folder, is an invaluable navigation tool for the EnCase Forensic interface. For whatever folder the “All Files” button is activated (green), in the active view on the right (Table, Timeline, Gallery, Report or Code view), all files and all folders within that particular folder will be displayed. In this way, it is possible to see files of many folders at once, not simply one folder at a time.
Lock-box
The “Lock” check box is used to lock the selected view when scrolling through files. For example, if the “Lock” is checked on the Hex view, switching to a graphic image in the Table view above will not automatically switch the lower-pane to the Picture view.