Advantages and Disadvantages of FTK and EnCase

	FTK	EnCase
1. Advantages	1.K can analyze data from several sources, including image files from other vendors 2. FTK produces a case log file Supports options and advanced searching techniques, such as stemming 3.FTK provides you the following advantages: · Simple Users’ Interface · Fast Searching · EFS Decryption · Bookmarking · Reporting · Password Dictionary Creation 4. FTK can create a keyword index of the entire image at the start of the process which makes futures searches easy. It is rare that you start a case with all the correct keywords... as a case develops; you often need to repeat searches with new keywords which can waste a lot of time. 5. E-mail Display FTK allows you to view e-mail in a user-friendly HTML. You can view native formats such as AOL IP addresses, POP3 servers, and view attachments. You can also document them in HTML reports. FTK can print or export e-mail messages and all associated attachments. It recognizes the source of the e-mail messages based on e-mail archives and special headers. Example : Show the Email display :	1.EnCase is quite outstanding - it is capable of breaking down complex file structures for examination, such as the registry files, dbx & pst files, thumbs db etc 2. Encase have time Line 3. Encase has full scripting abilities and allows automation of report ,decryption and carving
2. Disadvantages	No progress bar No multi-tasking No scripting support HFS (Mac) Not support 2 million File limit On gallery view Foes not fit picture to window No PSD support and no AVI support FTK no Time line except for sorting colums	1. EnCase Index needs work (a lot of work.) 2. No Outlook 2003 PST/OST Support 3. No Internal Mail Viewer 4. Rough looking Report 5. No full Indexing of the Drive 6. Live searches only 7. On gallery view Encase is constantly crashes on corrupt pictures 8. EnCase does not have to re-index order to apply hash list .the Case only need to be hashed once