Knowledgebase: E3
Guidelines for Upgrading Paraben’s P2C and DS to E3:Universal
Posted by Jack H. Ward on 14 November 2016 03:49 PM

About Electronic Evidence Examiner E3:Universal

Electronic Evidence Examiner (E3) is a comprehensive analysis tool combining plug-ins for computer forensic and mobile forensic analysis. You can purchase either a full version of Electronic Evidence Examiner or only its specific components (for example, for working with computer data (E3:P2C), or mobile data (E3:DS), or email databases (E3:EMX or E3:NEMX), etc.). These components are referred to as packages.

E3:Universal is a full version of Electronic Evidence Examiner which not only has all the functionality available in Paraben’s P2C and DS, but also includes a number of new features intended to make your investigations more convenient.

This document describes how to upgrade your P2C and DS applications to E3:Universal.

New Features

What’s New for both P2C and DS users:

  • A completely new interface designed to expedite navigation around the case.
  • A new type of licensing – Internet License allowing you to use your Electronic Evidence Examiner packages on multiple machines.
  • New Tutorial – a quick guide for first-time users.
  • Auto-exam option guiding you through the process of evidence examination and doing most things automatically without your interaction.
  • Reports Customization – the ability to add Examination Summary and Examination Conclusion sections to reports.

What’s New for P2C Users

  • The ability to change the data time zone for viewing evidence directly from the ribbon.
  • The ability to validate opened E3 mobile data cases.
  • New reports for E3 mobile data evidence.
  • Reports customization – the ability to add a custom logo, header and footer to reports.
  • The Open With feature for viewing binary files in external viewers.

What’s New for DS Users

General Changes:

Multithreading – now there is the ability to work with data during acquisition, import, or cloud import.

  • A task pool for viewing task progress and state.
  • The ability to select a specific data time zone for viewing evidence.
  • More usable bookmarks that can be categorized and organized in the hierarchical structure.

New Plug-Ins for Acquisition and Parsing:

  • New Android Spreadtrum plug-in for acquisition of Android devices with Spreadtrum chipsets.
  • JTAG plug-in for analyzing JTAG memory dumps.
  • SQLite plug-in for analyzing SQLite databases.
  • The ability to add Project-a-Phone folders as evidence and parse them.

New Analysis Functionality:

  • Improved sorting with the ability to use the Image Analyzer and eliminate internal application data and standard smileys from the sorted files.
  • Keywords indexing for performing quick keyword searches.
  • Optical character recognition for text extraction from graphic files.
  • Advanced searches including search using regular expressions and pre-defined CP (child pornography) search term list.
  • Usable sorted data search with the ability to use hash databases for filtering out common hashes.

New Exporting & Reporting Functionality:

  • The ability to export any category of Sorted files (not only Graphics and Multimedia).
  • A completely new Mobile Data Review Report providing data in the most comprehensive format for forensic investigators.

 

Upgrading Paraben’s P2C and DS to E3:Universal

If you have P2C and DS with valid subscriptions, it is recommended that you upgrade to E3:Universal to get access to all the new features offered to P2C and DS users. The upgrading process consists of the following steps:

  1. Sending an upgrade request to Paraben’s Support Center at forensics@paraben.com.
  2. Uninstallation of your P2C application.
  3. Uninstallation of your DS application.
  4. Uninstallation of the DS Driver Pack.
  5. Installation of Electronic Evidence Examiner.
  6. Installation of the new E3 Mobile Driver Pack.
  7. Activation of the E3:Universal package.

To request a P2C/DS to E3:Universal upgrade:

  1. E-mail Paraben’s Support Center (forensics@paraben.com) with a request to upgrade your P2C and DS to E3:Universal. Specify the following information:
    • Your Paraben account ID or dongle number.
    • Your current activation type (dongle or license key).
    • Please note that you can also request to change your activation type to
      Internet license to get the ability to use your E3:Universal on multiple machines without having to use the dongle.
  2. Once you get an upgrade confirmation from Paraben’s Support Center, log in to your Paraben account to find a new product ID (PID) generated for E3:Universal. 3. Now you can uninstall your P2C, DS, and DS Driver Pack and then start the Electronic Evidence Examiner installation.

Installing Electronic Evidence Examiner

To install Electronic Evidence Examiner:

  1. Download the Electronic Evidence Examiner installation file from
    http://download.paraben.com.
  2. Run the Electronic Evidence Examiner installation file.
  3. The Paraben’s Electronic Evidence Examiner Installation wizard opens. On the Welcome page, click Next.
  4. Read the License Agreement carefully and select I accept the terms of License
    Agreement if you accept the terms. Click Next.
  5. Select the Installation folder and click Next.
  6. If you are ready to begin the installation, click Install.
  7. The installation process starts. It may take some time.
  8. When the installation process finishes, the last page of the Installation wizard is displayed. Select the Open the Electronic Evidence Examiner Driver Pack download page checkbox and click Finish to exit the wizard. Please note that Electronic Evidence Examiner installation does not include mobile drivers. All the drivers for Electronic Evidence Examiner are included in the E3 Mobile Driver Pack.
  9. Electronic Evidence Examiner is installed and you can proceed to installing the E3 Mobile Driver Pack and activating your package.

Installing E3 Mobile Driver Pack

To install the E3 Mobile Driver Pack:

  1. Download the E3 Mobile Driver Pack from http://download.paraben.com.
  2. Run the E3 Mobile Driver Pack installation file.
  3. The E3 Mobile Driver Pack Installation wizard opens. On the Welcome page, click Next.
  4. Read the License Agreement carefully and select I accept the terms of License Agreement if you accept the terms. Click Next.
  5. On the Customize Setup page, select the way the drivers and tools will be installed and click Next.
  6. On the Ready to Install page, click Install if you are ready to begin the installation.
  7. The installation process starts. It may take some time. 8. When the driver installation is completed, click Finish to exit the wizard.

Activating E3:Universal

To activate E3:Universal with a dongle:

  1. Plug the dongle into your computer, start Dongle Manager and update the dongle.
    Please note: if you cannot find Dongle Manager on your machine, download it from http://download.paraben.com and install it.
  2. Install Dongle Manager on the computers where Electronic Evidence Examiner will be used. 3. Plug in the dongle and start Electronic Evidence Examiner.

To activate E3:Universal with a license key over the Internet:

  1. Start your Electronic Evidence Examiner and click Activate in the dialog displayed on start.
  2. In the Activation wizard, select Direct Machine License and click Activate.
  3. On the next page of the wizard, select the Over the Internet activation type and click Next.
  4. On the Enter Your Product ID (PID) page, click Add and enter the new Product ID generated for E3:Universal. Then click Activate.
  5. After the package is activated, the last page of the Activation wizard will be displayed. Click Finish to exit the wizard.
  6. E3:Universal is activated and you can begin using it.

To activate E3:Universal with a license key by telephone:

  1. Start your Electronic Evidence Examiner and click Activate in the dialog displayed on start.
  2. In the Activation wizard, select Direct Machine License and click Activate.
  3. On the next page of the wizard, select the By Telephone activation type and click Next.
  4. The Phone Activation page opens.
  5. Follow the steps described on the page: call the support center and dictate the new Product ID (PID) generated for E3:Universal and the Registration key displayed on the Phone Activation page.
  6. When you receive the Activation key, enter it in the corresponding field and click
    Activate.
  7. After the package is activated, you will see the last page of the Activation wizard.
  8. Click Finish to exit the wizard.
  9. E3:Universal is activated and you can begin using it.

To activate E3:Universal using the Internet license:

  1. Start Electronic Evidence Examiner and click Activate in the dialog displayed on start.
  2. The Activation wizard opens.
  3. In the Activation wizard, select the Internet License option (selected by default) and click Activate.
  4. The Connect to Web License Server dialog is displayed.
  5. Enter your Paraben user login and password and click Connect.
  6. Electronic Evidence Examiner connects to the web license server. Wait while it is checking whether there are any available E3 packages assigned to your account.
  7. E3:Universal becomes activated and you can begin using it.

Working with E3:Universal

The E3:Universal interface allows the most convenient navigation around the case.

P2C / E3:Universal Differences

There are no major differences between P2C and E3:Universal in regards to adding and analyzing evidence, exporting, or generating reports.

The only major change is the format of case files created in E3:Universal. Cases created in E3:Universal have the *.e3 format as opposed to the *.p2c format of cases created in P2C.

Please note that you can work with *.p2c cases in E3:Universal. To open a *.p2c file, in the Windows Open dialog, in the File Mask field, select P2C Cases (*.p2c).

DS / E3:Universal Differences

There are no major differences between DS and E3:Universal in regards to the process of data acquisition, import, or cloud import. However, the process of saving acquired or imported data and working with mobile data cases is different in E3:Universal.

Saving Acquired Data to Cases

Cases created in Electronic Evidence Examiner (*.e3 files) can store not only acquired/imported mobile data but also other types of data added as evidence.

Acquired/imported mobile data is saved as an E3 mobile data case, which is a *.ds file stored in the same folder as the Electronic Evidence Examiner case to which the data was acquired or imported. The E3 mobile data case file name has the following structure:

<Name of Electronic Evidence Examiner Case>_<Type of data acquisition (Acquisition, Import, or Cloud Import)>_<Date of acquisition/import/cloud import>_<Time of acquisition/import/cloud import>

For example, an E3 mobile data case attached to an Electronic Evidence Examiner case named Case (1).e3 will have the following name: Case_(1 )_Acquisition_11 -01 - 2016_13-57-30.ds

A new E3 mobile data case is created at the end of each acquisition/import/cloud import procedure. Thus, an Electronic Evidence Examiner case can have multiple E3 mobile data cases attached to it.

Opening E3 Mobile Data Case/DS Case Files

To view an E3 mobile data case (*.ds file), you need to open an Electronic Evidence Examiner case to which it is attached. For example, if you want to view the Case_(1 )_Acquisition_11 -01 -2016_13-57-30.ds file, you need to open the Case (1).e3 file with Electronic Evidence Examiner.

Adding E3 Mobile Data Case/DS Case File as Evidence

You can add E3 mobile data cases created in Electronic Evidence Examiner or DS case files created in Paraben's DS as evidence. You can add as many as you want to one .e3 case.

Auto-Exam

Introduced in E3:Universal, Paraben’s brand new Auto-Exam feature allows you to have your evidence processed automatically. You can select a sequence of actions to have performed on your evidence and let Electronic Evidence Examiner work with your data without your interaction.

Please note that all the content analysis options available in P2C are present in E3:Universal and are now available for acquired/imported mobile data as well.



Attachments 
 
 upgrading p2c and ds to e3 universal.pdf (2.96 MB)
(0 vote(s))
Helpful
Not helpful

Comments (0)