EnCase™ Forensic CE 22.3
Release Notes
Product Released: 2022-07-29

Contents
1

Introduction .................................................................................................................................... 4

1.1
2

Release Notes revision history .................................................................................................. 4
New features ................................................................................................................................... 4

2.1

New timeline view ...................................................................................................................... 4

2.2

AFF4 logical write support ......................................................................................................... 5

2.3

Read and parse physical AFF4 evidence files .......................................................................... 5

2.4

Updates to Pathways ................................................................................................................. 5

2.5

Parse evidence from Facebook information file ........................................................................ 5

2.6

Collect from Slack workplace communication tool .................................................................... 6

2.7

New macOS agent installer.sh script ......................................................................................... 6

2.8

Internet artifacts: updated Safari browser support .................................................................... 6

2.9

Updated language support ........................................................................................................ 6

2.10

Copy files from EnCase review package ................................................................................... 6

2.11

Java Runtime Edition updated................................................................................................... 7

2.12

Mobile enhancements ............................................................................................................... 7

2.13

Online help improvements ......................................................................................................... 7

2.14

EnCase Artifact Reference Guide updates ................................................................................ 7

3

Mobile application data acquisition ............................................................................................. 7

4

SAFE version .................................................................................................................................. 9

5

Product licensing ........................................................................................................................... 96

Packaging and documentation ................................................................................................... 10

7

Supported environments and compatibility .............................................................................. 10

7.1

Supported Operating Systems ................................................................................................ 10

7.2

Target machine operating systems .......................................................................................... 10
McAfee ePolicy Orchestrator (ePO) integration ......................................................... 11

7.3

Supported file systems ............................................................................................................ 11

7.4

Third party systems ................................................................................................................. 12

7.5

Encryption support ................................................................................................................... 12

7.6

Cloud service support .............................................................................................................. 13

7.7

USGCB compliance ................................................................................................................. 14

8

Fixed issues .................................................................................................................................. 14

9Known issues ............................................................................................................................... 16

EnCase Forensic 22.3 Release Notes

2

10 Download documentation from OpenText My Support ............................................................ 22
11 Contact information ..................................................................................................................... 26

EnCase Forensic 22.3 Release Notes

3

1 Introduction
These Release Notes provide an overview of EnCase Forensic 22.3, including new features, delivery
information, and supported platforms.
OpenText recommends that you read these Release Notes in conjunction with the documentation
included with the software package. If any conflicts exist, the Release Notes supersede the otherdocumentation.
We also recommend that you check OpenText My Support (https://support.opentext.com) for any
patches or documentation updates that may have been posted after the initial release of this product.

1.1

Release Notes revision history

Revision date

Sections revised

Description of revisions

2022-07-29

First release.

All new content.

2 New features
This section provides an overview of EnCase Forensic 22.3 new features.

2.1

New timeline view

The timeline feature in EnCase Forensic has been completely updated and modernized. Select files in
the Tree or Table view and switch to the Timeline view to see the selected evidence in the newTimeline format. Users can drill down on the data, adjust the date range, and customize which datatypes are displayed. Hover over a column to get a count of data types in that date bucket. Timeline

EnCase Forensic 22.3 Release Notes

4data can be selected and bookmarked. The new Timeline view has numerous, flexible ways ofviewing and presenting data visually. See the EnCase Forensic User Guide for more information.

2.2

AFF4 logical write support

EnCase Forensic now supports logical evidence file creation in AFF4-L format.
The following compression options are available:
•
•
•
•
•

Disabled (no compression)
SnappyLZ4DeflateDeflate (Zhlub)

The following algorithms are supported for creating linear hashes:
•
•
•
•
•

MD5
SHA1
SHA256
SHA512Blake2b512

EnCase Forensic users have access to advanced AFF4 settings via Registry Key Overrides as well.
Advanced features include:
•
•
•
•
•
•
•

2.3

Bevy Size - chunk storage segment size for AFF4's Image Stream.
Chunk Size - chunk (or block) size in KB utilized for data storage.
Cache Capacity - maximum number of chunks to hold in AFF4 read cache.
Compress Level - specify the compression level for Deflate algorithm.
Image Size Threshold - file size limit for small files.
Thread Count - maximum number of worker threads.
Pyaff4 Workaround - Third party tools (like wingmen and pyaff4) have various limitations andexpect AFF4 images to be written in a certain way. If the image generated by EnCase is to be
used with one of these tools, activate this option and set the value according to the list.

Read and parse physical AFF4 evidence files

EnCase Forensic can now read and parse physical AFF4 evidence files. Zip containers and directory
containers (*.aff4 and *.turtle extensions) are supported. Multi-volume parsing (*.A01, *.A02,…) is supported.

2.4

Updates to Pathways

The Pathways workflow tool in EnCase Forensic has been substantially updated. Pathways are now
more modular, making it easier to share Pathways between users.

2.5 Parse evidence from Facebook information file
You can now use EnCase Forensic to collect and parse evidence from a user’s Facebook information
file. The Facebook information file is a JSON file generated by Facebook via a user’s account. It is a

EnCase Forensic 22.3 Release Notes

5collection of a user’s photo albums, comments, messages, and posts. Access this functionality via
EnCase Forensic Add Evidence > Acquire > Storage. The evidence is output into a logical evidence
file.

2.6

Collect from Slack workplace communication tool

You can now use EnCase Forensic to collect evidence from the Slack workspace communication tool.
Both group and direct messages are available for collection. Evidence can be filtered by date and thecollected evidence can be examined in the Artifacts or Social Media Artifacts tabs of EnCase
Forensic. You can also perform a preview instead of collecting into an evidence file. Access Slackcollection via EnCase Forensic Add Evidence > Acquire > Storage. The evidence is output to alogical evidence file.

2.7

New macOS agent installer.sh script

The macOS agent can be installed by using installer.sh script available in addition to
installer.zip. To use the script, copy installer.sh file to the target machine /tmp folder, set
execute permission for the script and run it as a root.

2.8

Internet artifacts: updated Safari browser support

EnCase Forensic has updated support for internet browser artifact acquisition from the Apple Safari
web browser, version 70.0.3538.67.

2.9

Updated language support

The EnCase Forensic user interface has been updated for the following languages:
•
•
•
•
•
•
•
•
•
•
•
•
•

ArabicChinese (Simplified)
Chinese (Traditional)
Dutch
FrenchGermanItalianJapanese
KoreanPolishPortuguese
SpanishTurkishThese language versions of EnCase Forensic are available for download on OpenText My Support.

2.10 Copy files from EnCase review package
The EnCase Evidence Viewer included with EnCase Forensic now allows users to select any file andcopy it out of a review package.

EnCase Forensic 22.3 Release Notes

6

2.11 Java Runtime Edition updated
EnCase Forensic now includes Java Runtime Edition 18.0.1.1.

2.12 Mobile enhancements
The Permissions Details grid is added for data received during the logical acquisition from the iOS
devices and iOS backup import. The Permissions Details grid contains information about thepermission modification date and reason.

2.13 Online help improvements
When accessing EnCase Forensic online help, EnCase SAFE User Guide and EnCase Artifact
Reference Guide are now available to users in a convenient tabbed format. Simply click on thecorresponding tab from the online help page to access these guides.

2.14 EnCase Artifact Reference Guide updates
The EnCase Artifact Reference Guide contains all new artifacts introduced in the 22.3 release as wellas previously published artifacts. The EnCase Artifact Reference Guide is available as online help andas a download on OpenText My Support. This comprehensive guide contains information on theartifacts collected using EnCase Forensic.

3 Mobile application data acquisition
EnCase Forensic allows you to acquire parsed mobile application data. The parsed application data
includes grids with types of data corresponding to its application, such as Contacts, Conversation,
Downloads, History, and more. Parsed data can be collected from either the device acquisition or the
cloud acquisition.

Application

iOS

AndroidBlackBerry 10
BackupCloud Data
ImportAmazon Alexa
BB Messenger
Chrome
DJI GoDolphin browser
Dolphin X browser
Evernote
Facebook

EnCase Forensic 22.3 Release Notes

7

Application

iOS

AndroidBlackBerry 10
BackupCloud Data
ImportFacebook Messenger(iOS 7.x andhigher)FirefoxFitbit
Gmail
Google Maps
Google Drive
iCloud Backup*
Instagram
Jott Messenger
KIK
LinkedIn
Mail.ru
Opera
Opera Touch
PingerSkype
Snapchat
Telegram
TextFree
TextPlus
TigerConnect
TikTokTinder

EnCase Forensic 22.3 Release Notes

8

Application

iOS

AndroidBlackBerry 10
BackupCloud Data
ImportTwitter
Viber
Vkontakte
VoiceMail
Waze
WeChatWhatsApp
WhisperYik Yak* iCloud Backup is not a parsed application but is included here because it is accessed via Cloud
Data Import.

4 SAFE version
Use the latest version of SAFE 22.3 with this product. The latest version of the SAFE is available from
OpenText My Support.

5 Product licensing
The CodeMeter product licensing client for EnCase Forensic is v7.30a.
The CodeMeter license server is the current, supported product licensing mechanism for EnCase
products. The legacy License Manager application used by some existing customers is still supported,
but will be deprecated in a future release.
Documentation for License Manager can be found in the SAFE 20.4 User Guide.
EnCase Forensic and EnCase Endpoint Investigator 22.3 users:••

New and current users
If you are a new user, or do not use the legacy License Manager.
o Use CodeMeter license server. Refer to your product’s 22.3 user guide for
instructions on installing and configuring the CodeMeter license server.
o Refer to the SAFE 22.3 User Guide for information about SAFE and agent
deployment.
Legacy License Manager users
If you currently use License Manager, you may continue to use License Manager until it isfully deprecated, or you can migrate to CodeMeter license server.
o If you want to stop using License Manager, refer to your product’s 22.3 User Guide
for instructions on installing the CodeMeter license server.

EnCase Forensic 22.3 Release Notes

9

o
o

If you do not want to stop using License Manager at this time, refer to the SAFE 20.4
User Guide for information about License Manager. Refer to the SAFE 22.3 User
Guide for all information about the SAFE and agent deployment.
CodeMeter licensing server is not compatible with EnCase Forensic versions older
than v20.x. If you intend to use EnCase Forensic versions older than 20.x, consider
keeping enough licenses for your needs with your existing License Manager server.

6 Packaging and documentation
Downloads and documentation for EnCase Forensic are available on OpenText My Support(https://support.opentext.com). Documentation for this product includes:•••

EnCase Forensic User Guide
EnCase Artifact Reference Guide
SAFE User Guide

7 Supported environments and compatibility
This section provides details about supported platforms, systems, and versions.

7.1

Supported Operating Systems

EnCase Forensic works on machines running the following operating systems:••

Microsoft Windows 8.1, Windows 10 versions 1607, 1703, 1709, 1803, 1809, 1903, 1909,
2004, 21H1, 21H2, Windows 11
Microsoft Windows Server 2012 and 2012 R2, Windows Server 2016, Windows Server 2019,
Windows Server 2022

Minimum and suggested system requirements for this product are provided in the “System
Requirements” section of the EnCase Forensic User Guide.
The Java Runtime Edition included with EnCase Forensic is now 18.0.1.1.

7.2

Target machine operating systems

Agents are deployed on target machines and can be used to search the following operating systems:

EnCase Forensic 22.3 Release Notes

10

TargetOperating
SystemProcessor

Logical &PhysicalAcquisition

MemoryAcquisition

Versions

AIX

6.1, 7.1

64-bit

Yes

No

HPUX

11.0, 11.1x,
11.2x

32-bit, 64-bit

Yes

No

Linux Kernels

2.6.4 or higher
with procfs

x86, x64, ARM, ARM64, IBM Z

Yes

No

macOS

10.12 – 12 1,2x64,
ARM64 (v11.x and higher only)Yes

10.12 – 10.14

Red Hat
EnterpriseLinux6, 7, 8, 8.1

x86, x64

Yes

7, 8, 8.1

Solaris10 – 11.4

SPARC64

Yes

No

Windows

7 SP1, 8, 8.1

x86, x64

Yes

Yes

Windows 101507 – 21H2,
IoT Core

x86, x64, ARM, ARM64 (limited)

Yes

1507 – 21H2,
IoT Core 3

Windows 11

21H2

x86, x64

Yes

Yes

Windows
Server

2008, 2008 R2,
2012, 2012 R2,
2016, 2019,2022

x86, x64

Yes

Yes

1

macOS 12 can only be previewed with Live Directory Preview.

2

There are other limitations related to agent deployment on macOS devices. Refer to theKnown issues section for more information.

3

Support for Windows 10 ARM64 is limited. Memory acquisition is not supported and snapshot
does not include open files, handles, and DLLs.

McAfee ePolicy Orchestrator (ePO) integration
McAfee ePolicy Orchestrator administrators can use ePO to deploy EnCase agents to ePO-managed
nodes. Versions 4.5, 4.6, 5.1, and 5.3 are supported.

7.3

Supported file systems

EnCase Forensic can read and acquire from the following file systems.
APFS

CDFS

EnCase Forensic 22.3 Release Notes

EXFAT

EXT2

EXT3

EXT4

11

FAT

FAT12

FAT16

FAT32

HFS

HFS+

HFSX

HPFS

HPUXFSJFS

JFS2NETWARENTFSREISERSOLZFS

SUN

UDF

UFS

UFS2

VXFS

XFS

YAFFS2

ZFS

7.4

Third party systems

SystemDescription

Project VIC data model

1.2

7.5

Encryption support

VendorProduct

Supported versions

64-bit support

Apple

Apple File System (APFS)
Encryption

10.15

Yes

Check Point

Endpoint Security Suite (FullDisk Encryption)

6.3.1 up to 7.4, 8.0 (forWindows and Macintosh
computers). 80.64 - 80.94(Windows only).

Yes

Credant

Mobile Guardian (subsumed
by Dell)

5.2.1, 5.3, 5.4.1, 5.4.2, 6.0
through 6.8, 7.3

Yes

Dell

Data Protection Enterprise
Edition

8.3, 8.5, 8.12, 8.13, 8.15, 8.16,
8.17.2

Yes

Dell

Full Disk Encryption

8.17, 10.7, 10.8

Yes

GuardianEdge

Encryption Plus/Anywhere

7 and 8

No

GuardianEdge

Hard Disk Encryption

9.1.5, 9.2.2, 9.3.0, 9.4.0, 9.5.0,
9.5.1

Yes

McAfeeEndpoint Encryption(formerly SafeBoot)

4, 5, 6, 7, 7.1, 7.2 (forWindows and Macintosh
computers)

Yes

Microsoft

BitLocker and BitLocker To
GoWindows Vista (Enterprise andUltimate), Windows 7, 8, 10,Windows Server 2008.

Yes

EnCase Forensic 22.3 Release Notes

12

Vendor

Product

Supported versions

64-bit support

Sophos

SafeGuard Easy andEnterprise (formerly
Utimaco)4.5, 5.5, 5.6, 6.0

Yes - SafeGuard
Easy
No - Enterprise

Symantec

PGP Whole Disk Encryption

9.8, 9.9, 10, 10.1, 10.2, 10.3

Yes

Symantec

Endpoint Encryption

7.0.2, 7.0.3, 7.0.4, 7.0.5, 7.0.6,
7.0.7, 7.0.8, 8.0, 8.2, 8.2.1,
9.1, 11.1.1, 11.1.3, 11.2, 11.3

Yes

Vera

Vera for Files

2.1

Yes

WinMagic

SecureDoc Full Disk
Encryption and SelfEncrypting Drives

4.5-8.6

Yes

7.6

Cloud service support

EnCase Forensic can acquire user email and related items from the following online email services:•••

Microsoft Exchange Server 2013 or Later
Microsoft Exchange Server on Office 365
Google Workspace

EnCase Forensic can acquire files from the following online file storage and sharing services:
•
•
•
•
•
•
•
•

Amazon S3
Box
DropboxGoogle Workspace
Microsoft Azure Blob
Microsoft SharePoint 2013 or Later
Microsoft SharePoint Office 365
Microsoft SharePoint Office 365 OneDrive

EnCase Forensic can acquire files from the following online messaging services:••

Microsoft Teams
Slack

EnCase Forensic can acquire files from the following online social sharing services:•••

Facebook
Instagram
Twitter

EnCase Forensic 22.3 Release Notes

13

7.7

USGCB compliance

EnCase Forensic has been validated as USGCB compliant using the following version of NIST VHD
images:
2/27/17 (for Windows 7 only)
EnCase Forensic was tested using Retina Network Security Scanner, which is a NIST validated
USGCB scanner (http://usgcb.nist.gov/usgcb/microsoft_content.html).

8 Fixed issues
Issue number

Issue description

AGENT-6173

An issue with the Solaris 9, 10, and 11 EnCase agent that resulted in thedisplay of both device and symbolic links has been fixed. Now, the device isshown only once.

AGENT-6285

An issue with SAFE installation that could prevent all EnCase AgentManagement components from being upgraded has been resolved.

AGENT-6335

In an Azure VM deployment, an issue that prevented the EnCase AgentManagement (AMP) component from automatically restarting following
deallocation/reallocation has been fixed.

AGENT-6636

An issue with the SAFE 22.1 EnCase Agent Management Platform (AMP) thatprevents the AMP service from automatically starting in Azure environments
following deallocation and reallocation has been fixed.

AGENT-6637

The EnCase Forensic Remote Job Monitor would display a “DownloadError”
message if an attempt was made to upgrade a SAFE to v22.1 while a job was
being dispatched. This issue has been fixed.

AGENT-6685

An issue with SAFE that prevented non-keymaster users from viewing Network
Plugin Repository plugins has been fixed. Users can now view the plugins
regardless of role permission. The ability to edit the plugin list remains
unchanged: only those users with the Manage Network Plugin Repositoryrole permission can edit plugins.

AGENT-6862

An issue that caused the Windows agent installer to install the incorrect agent
on ARM64 machines has been fixed.

FOR-27553

When creating a snapshot of macOS devices EnCase Forensic now display
the name of the Monterey operating system. Previously, this version of macOS
was not displayed.

EnCase Forensic 22.3 Release Notes

14

Issue number

Issue description

FOR-30355

An issue with the display of application details (such as, application name,icon, and version), has been fixed for the Application List grid received during
the iOS Backup import.

FOR-30355

An issue with the missing Application Permissions grid has been fixed for iOS
Backup import.

GUIDTS-1969

In EnCase Forensic, erratic application behavior could occur if a user clicked
the Next Hit button to move through raw text search hits in the view pane, if
the pane was undocked. This issue has been fixed.

GUIDTS-4647

An issue that prevented EnCase Forensic from completing a mobile acquisition
when System Locale settings were set to Chinese (Simplified, China) has been
fixed.

GUIDTS-4777

An issue where EnCase Forensic would not display the Tools > Options > Do
not verify evidence when opened check box for all versions of theapplication has been fixed. The option to turn off evidence verification is now
universally available.

GUIDTS-4948

The export progress bar has been fixed and extraneous options have been
removed from the review package export dialog in EnCase Forensic.

GUIDTS-4959

An issue with the EnCase Evidence Viewer application that rendered files in
the Report Name field as a clickable hyperlink has been fixed. The file name is
now rendered as regular text like other fields.

GUIDTS-4982

An issue was fixed in which running conditions containing multiple functions
and criteria in EnCase Forensic, deselecting items at the child level andrunning the condition again could return unexpected results.

GUIDTS-4983

An issue that prevented third-party tools from conducting high-volume I/O
operations when interacting with the VFS module in EnCase Forensic has
been fixed.

GUIDTS-5005

An issue with EnCase Portable that resulted in hash matched files not being
collected has been fixed.

GUIDTS-5489

An issue in EnCase Forensic that prevented bookmarked table data fromdisplaying in reports has been fixed.

GUIDTS-5524

An issue was identified in EnCase Forensic when bookmarking raw text in
Hex/Text view. The area selected by the user is not highlighting and thebookmarked area is not indicated. This issue has been fixed.

EnCase Forensic 22.3 Release Notes

15

9 Known issues
Issue number

Found in

Description

AGENT-6301

22.1

CodeMeter licensing was upgraded to v7.30a with the EnCase
Forensic 22.1 release. CodeMeter is not compatible with Microsoft
Windows 7. EnCase Forensic 22.1 can be installed on Windows 7
machines; however, the installer will throw an error and the
CodeMeter component will not be installed. If using the installer to
upgrade EnCase Forensic 22.1 from a previous version, the error
will still be displayed, and CodeMeter 7.30a will not be installed.
The application will attempt to use the previous most recent version
of CodeMeter for licensing.

AGENT-6551

22.1

When using Live Directory preview on macOS systems to viewprotected folders (Desktop, Documents, Downloads, etc.), the
EnCase macOS agent (enmacos) requires full disk accesspermission. This can be set either via MDM profile if the agent isdeployed through MDM or by adding the enmacos agent to thefollowing allow list: System Preferences > Security and Privacy >Privacy > Full Disk Access.

DOC-310922.1

Media analysis module performance is degraded on systems that
do not have a minimum of 4GB of RAM per logical core. For further
guidance on optimizing memory usage for the Media analysis
module and the Evidence Processor, see Knowledge Base article,
KB20533873.

FOR-25948

22.1

In this release, the new Windows registry keys added to System
Info Parser in EnCase Forensic 21.4 have been moved from theAuto Start folder to the Other folder. Registry keys are viewed andselected by clicking on the System Info Parser link in the EnCase
Processor Options dialog, viewing the Advanced tab on the dialog,
and opening a folder. In EnCase Forensic 22.1, the new keys willappear in the Other folder only for evidence not processed in aprevious version. For evidence processed with version 21.4, thesekeys appear in the Auto Start folder. Once evidence is processed,
keys selected from a particular folder would be found under thecorresponding folder in the Artifacts tab.

DOC-3021

21.4

The additional Windows Registry keys parsed by EnCase Forensic
21.4 System Info Parser are located in the AutoStart folder. These
will be placed in the appropriate Registry Commands subfolder in a
future release.

EnCase Forensic 22.3 Release Notes

16

Issue number

Found in

Description

FOR-24486

21.4

When users open a case processed by an earlier version of
EnCase Forensic the case will not contain newer registry keys
unless processed again with EnCase Forensic 21.4.

GUIDTS-4747

21.4

When acquiring evidence to .Ex01 the Restart Acquisition option
is selectable. but this function does not support .Ex01 file formats.
Attempting to restart acquisition of an .Ex01 file using this function
will not succeed.

AGENT-5363

21.2

The EnCase agent installed on macOS 11 (Big Sur) is installed
without kernel extensions and can make snapshots, logicalacquisitions, and previews. The EnCase agent installed on macOS
11 cannot acquire physical memory, physical devices, or accesslocked or mounted devices.
The EnCase agent installed on macOS 10.15 and earlier is installedwith kernel extensions and can acquire physical memory, physicaldevices, and access locked or mounted devices on macs unlessthe machine is equipped with a T2 encryption chip. Macs equippedwith the T2 encryption chip cannot perform physical diskacquisitions.

FOR-22695

21.2

When using three periods (...) to enter a date range in EnCase
Forensic, running a condition removes one of the periods, resulting
in an error. A workaround is to select the Prompt for value
checkbox on the Terms tab of your condition. When the condition isrun, adding the period where EnCase has removed it will run thecondition without error.

FOR-21258

21.1

In some situations when running the Chinese Simplified version of
EnCase, the display text may not render properly. Installing the Arial
Unicode MS font and setting it in Tools > Options > Fonts will
resolve the issue.

GUIDTS-4268

21.1

EnCase Forensic does not support opening more than ten
concurrent cases. Opening more than ten concurrent cases causes
the recently opened case list to cycle through the cases, preventing
the user from selecting the first opened case.

FOR-19247

20.4

Under certain circumstances, EnCase Forensic can fail to parse
ZFS volumes on identical devices.

FOR-19252

20.4

Under certain circumstances, EnCase Forensic can fail to parse
ZFS volumes in virtual environments when using GPT partitions.

EnCase Forensic 22.3 Release Notes

17

Issue number

Found in

Description

FOR-19968

20.4

The OneDrive preview feature does not support bookmarking. If
you want to bookmark an item, you must acquire it first, thenbookmark it.

FOR-20225

20.4

In some cases, installing EnCase Forensic on a system that alreadyhas EnCase Forensic installed will generate a file lock error onenportv.sys. This can prevent EnCase fonts from loading
properly. Restarting the system after installation resolves the issue.

FOR-20283

20.4

In some circumstances, installing HASP drivers can cause certain
Windows 10 machines to deliver a stop error. As a result, the HASP
driver installation has been unchecked by default. If you still use a
HASP dongle, OpenText recommends replacing it with either
CodeMeter or an electronic license. Contact OpenText Customer
Service for a replacement.

GUIDTS-2998

20.4

An issue in EnCase Forensic was identified that prevents indexingof East Asian characters. Searching for more than a single
character does not return results.

AGENT-4536

20.3

The EnCase agent is not supported on target machines with ARM
processors running Windows 10 S mode.

FOR-19065

20.3

Some APFS snapshots on physical images are not added to theevidence view after processing. This is a result of system changes
during acquisition that render the snapshot invalid.

AGENT-4120

20.2

Physical acquisition of a Macintosh device with a T2 chip is
possible but unusable since keys are stored in the T2 chip and theacquired image cannot be decrypted. The workaround is to do alogical acquisition on the device.

DOC-2410

20.2

Support for McAfee Drive Encryption up to version 7.2.9.14 works
in offline mode (using the XML file). However, online credentials
validated on the live server do not decrypt the evidence. The
current workaround is to manually export the XML file from theserver and use this file for offline decryption.

FOR-17297

20.2

When collecting from a Macintosh running APFS, acquiring adevice before an encryption process is completed can lead topartially encrypted entries that are unreadable in EnCase Forensic.
It is recommended acquiring a device after the encryption process
is complete.

EnCase Forensic 22.3 Release Notes

18

Issue number

Found in

Description

FOR-17894

20.2

When running the Recover Folders option in the Evidence
Processor, the entry count in the Recovering notification is incorrect
because it does not include counts from alternate data streams.
The correct count is displayed elsewhere in the application, where
alternate data streams are included.

GUIDTS-3542

20.2

On some workstations with restrictive Windows policies, EnCase
Forensic may be prevented from loading a font used in theapplication UI. If you encounter a missing font in the UI, a solution
is available in the following KB article on OpenText My Support:
https://knowledge.opentext.com/knowledge/cs.dll/kcs/kbarticle/view/
KB14814908.

FOR-15542

8.10

Indexes generated with previous versions of EnCase
Forensic (v8.09 and earlier) are incompatible with EnCase Forensic
v8.10. If you want to view indexed data in EnCase Forensic v8.10,
you must re-index it.

FOR-16248

8.10

EnCase Forensic v8.10 installation fails on machines running
Windows 10, version 1507. Installation of EnCase Forensic v8.10
works on Windows 10 versions that are more recent than version
1507.

FOR-16505

8.10

When a user provides secure storage credentials for a McAfee fulldisk encrypted physical evidence containing partitions, and thenreacquires it, the newly acquired evidence will contain decrypted
data. However, the new evidence will contain the McAfee partition
that designates the other partitions as still encrypted, and it is this
McAfee partition that EnCase Forensic uses to flag the otherpartitions as encrypted. This results in EnCase Forensic repeatedly
prompting the user for credentials. If the user then cancels thecredential dialog, EnCase Forensic will read the decrypted data as
if there was no encryption.

MobileAcquisition Android

8.10

Android 9 is partially acquired by the physical plugin.

MobileAcquisition Android Logical

8.10"Connection was broken" appears for ZTE Z799 Android 6.0.1
device during logical acquisition.

MobileAcquisition Cloud Import

8.10

Authentication in Google Locations fails with Invalid Credentials
error.

EnCase Forensic 22.3 Release Notes

19

Issue number

Found in

Description

MobileAcquisition Cloud Import

8.10

Authentication has failed for Twitter cloud import with "Invalid
credentials" error.

MobileAcquisition Cloud Import

8.10

iCloud Backup - Authentication fails with Invalid credentials error.

MobileAcquisition iPhone
Physical

8.10

Physical Acquisition by DFU mode fails with error.

FOR-14141

8.09

When selecting an APFS container in the Network Preview Screen,
the data on the APFS volume needs to be frozen before previewing
or collecting it. A small snapshot file is created that remains on thedevice until the parsing of the data is complete, at which point thesnapshot is removed. The Allow Live APFS Snapshot global option
enables this snapshot to be created; the option is selected bydefault and cannot be cleared without incurring unreliable andinconsistent results.

FOR-14076

8.09

Copying files from a result set that contains entries from an APFS
volume may fail. If this occurs, an error displays, stating you only
have permission to process a certain number of the selected files.
This behavior does not happen consistently, and does not happen
when copying files from entries, or when copying files from other filesystems.

FOR-14067

8.09

Viewing indexed items selected by Item Type may display
inconsistent results.

FOR-14062

8.09

Under certain conditions, jobs may fail when reprocessing APFS
evidence.

FOR-14049

8.09

Encrypted APFS volumes will not parse on two devices if a correct
password is entered for one device and an incorrect password isentered for the other.

FOR-14040

8.09

After creating a raw text bookmark, selecting an entry, and thenselecting hash/sig on that entry, EnCase Forensic may crash whenclicking the refresh button.

FOR-14032

8.09

For an encrypted APFS volume, clicking Rescan directly does notparse the volume if more than three incorrect passwords have been
centered consecutively.

EnCase Forensic 22.3 Release Notes

20

Issue number

Found in

Description

FOR-14023

8.09

When repeatedly viewing certain indexed items, EnCase Forensic
may crash. This behavior is infrequent.

FOR-14006

8.09

When processing evidence, the Index option in the view menu cansometimes incorrectly display as enabled or disabled.

FOR-13924

8.09

When using the default disk allocation of 10% for enhanced agent
jobs on VMs or small disks, the job may fail. Changing the default tobe >20% or making the segment size smaller will help prevent thisissue.

FOR-13772

8.09

When reprocessing a version 8.08 case using thumbnails and hashoptions, the wrong hash value is displayed. If this happens, delete
the cache and process the evidence again from the beginning.

FOR-11505

8.08

Non-English builds of EnCase Forensic are not supported on 32-bit
operating systems.

FOR-11549

8.08

In Japanese, Chinese, and Korean builds of EnCase Forensic
running on Windows 10, paths are not displayed correctly becauseof an underlying font issue. To work around this issue, install the
Arial Unicode MS font from Microsoft.

FOR-12474

8.08

When previewing and acquiring process memory from targets
running macOS 10.6 and 10.10, EnCase Forensic returns all zeros.

FOR-12677

8.08

Vera encrypted files inside of an unencrypted .ZIP file are notdecrypted when Vera decryption is set to Offline Mode.

FOR-10826

8.07

Due to the structure of APFS containers and volumes, navigation of
APFS devices in disk view can appear confusing when moving
across clusters.

FOR-10958

8.07

When dropping APFS evidence into EnCase Forensic, the data fails
to load if you process the evidence before opening it. The
workaround is to open the evidence first and then process it.

FOR-11089

8.07

Because EnCase Forensic parses macOS APFS volumes directly,
the timestamp values of files match those found in the terminal
command line rather than the corresponding timestamp values
displayed in the Finder.

FOR-9404

8.06

When you process evidence with the Expand compound files
option selected, file transcripts cannot be directly viewed within thecompound file. You must select an individual file within the archive
file to view a transcript of that file.

EnCase Forensic 22.3 Release Notes

21

Issue number

Found in

Description

FOR-9507

8.06

Compound words containing any of the following three stop words(period/dot, underscore, single quote) do not highlight the entire
word in highlight view. For example, a search for the word,
primary, would only highlight the word primary inprimary.user@email.com, but not the text after the period,.user@email.com. This issue only affects highlighting. Searchand indexing are unaffected by this highlighting issue.

FOR-7547

8.05

Triage reports will not show bookmarks created using Bookmark
Page as Image.

FOR-7559

8.05

EnCase Forensic does not support outputting mobile acquisition toa UNC path (\\server\folder).

FOR-7577

8.05

EnServer will not install on a Windows 7 64-bit VMWare workstation
without .NET Framework 4.6 installed.

10 Download documentation from OpenText My Support
You can access all your product documentation from the OpenText My Support website, including
release notes, user guides, and other resources.
To download documentation from the OpenText My Support website:
1. Using a web browser with access to the internet, navigate to https://support.opentext.com.
The OpenText Connect sign in page appears.

EnCase Forensic 22.3 Release Notes

22

2. Enter your email and password in the Sign in box and click Login or, if you have notregistered with OpenText, enter your email and password in the Register box and click Create
account. The My Support welcome page appears.

3. Select Products on the top menu bar. The My Support Products page appears.

EnCase Forensic 22.3 Release Notes

23

4. In the search box, enter the name of the product for which you want to download
documentation.

5. Select the product from the list. The Contents and Resources section is displayed below the
search bar.

EnCase Forensic 22.3 Release Notes

24

6. Select the Documentation link. The product page displays folders with current and recent
version numbers.

7. Select the product folder with the desired version number. A document folder for the productis displayed.

8. Click on the desired document to download.

Note
We recommend bookmarking the product folder page so you can easily
return to the page as needed to download additional documentation.
Account authentication is required to access the page.

EnCase Forensic 22.3 Release Notes

25

11 Contact information
OpenText Corporation
275 Frank Tompa Drive
Waterloo, Ontario
Canada, N2L 0A1
OpenText My Support: https://support.opentext.com
For more information, visit www.opentext.com

Copyright © 2022 Open Text. All Rights Reserved.

Trademarks owned by Open Text. One or more patents may cover this product. For more information, please visit https://www.opentext.com/patents.

Disclaimer

No Warranties and Limitation of Liability
Every effort has been made to ensure the accuracy of the features and techniques presented in this publication. However, Open Text Corporation and its affiliates accept
no responsibility and offer no warranty whether expressed or implied, for the accuracy of this publication.

26