1. Case Management

• Media examination within EnCase 6/7 is organized into cases.

• Case management involves creation and usage of the following folder structure on forensic examiner's computer:

      cases
          case001
          case001
          ...
          caseNNN
              evidence
              export
              index
              temp
              reports
              images
              caseNNN.Case
  

• The structure is designed to to maintain a set of unique folders for every examination.

• The lab must maintain separate folder for each investigation.