EL CREPÚSCULO DE LA REALIDAD

Before you begin

Be sure you have reviewed the specifications required for an examiner service machine.

The data service needs to have already been installed.

The desktop client must have already been installed.

The EnServer must be stopped.

The examiner service machine must be able to connect to the data service Web site.

The logged on user must be able to connect to the data service Web site.

The logged on user must have administrator rights.

Close all instances of EnCase.

A domain or local account with Read/Write permissions is needed to create a Windows service on the local machine. The account also needs Read/Write permissions to the DataService Web service, the global SQL database, and all case SQL databases.

Note: If you are installing the Examiner Service and do not already have the desktop client or EnCase installed, and if you are using either a CodeMeter physical security key or electronic licensing, you must manually install the CodeMeter software. From your installation media, navigate to Installers\CodeMeter and run CodeMeterRuntime32.exe or CodeMeterRuntime64.exe, depending on your system architecture. You can also download these files from http://www.wibu.com/us/codemeter.htm.

To install the examiner service:

1. Double click the examiner service installation file. The installer checks for Microsoft .NET 4, Microsoft Visual C++ 2005 and 2010, and installs them if needed. Follow the installation screens for each required component and click Finish when done.

2. The examiner service installation wizard displays. Click Next.

3. On the End-User License screen, click I agree and accept, then click Next. The Destination Folder dialog displays.

4. Modify the default installation path or accept the default. Click Next to proceed. The Configure Examiner Service dialog displays.

Enter the information needed to connect to your data service global and case sites in IIS. These URLs were created during the data service installation.

• Service name is pre-populated and cannot be changed.

• Global database Data Services URL is the address of your global database site (i.e., http://localhost:[data service port]/Global/). The port should be the port used for the data service (default is 8080).

• Case/data store database Data Services URL is the address of your case database site for EnCase eDiscovery users, or the data store site for EnCase Cybersecurity users (i.e., http://localhost:[data service port]/Case/). The port should be the port used for the data service (default is 8080).

• Temp folder path is for temporary files.

− This folder should be located on a drive with greater than 15GB of free space.

− This folder should be located on the fastest temporary drive or array available.

− This folder can not be a sub-folder in the Users, Program Files, or Program Files (x86) folders.

− It is strongly recommended that this folder not be on the same drive as where the operating system is installed as it is easy to switch one and not the other.

5. When done, click Next. A dialog displays prompting you to enter the credentials to be used when creating the examiner Windows service.

• Specify a domain/local user as the authorized user.

Note: If the data service is configured to use Windows authentication, the user specified in this field must be an authorized user for the data service. Authorized data service users are specified in the web.config file. See Setting up Windows Authentication for the Data Service see "Setting up Windows Authentication" on page 75 for details.

• This must be a credential that has Read/Write access to your global and case databases.

6. When done, click Next. A confirmation dialog displays.

7. To begin installing the examiner service, click Install. A status bar displays the progress of the installation. This may take several minutes.

8. If the installation is successful, a confirmation dialog displays. Click Finish to complete the installation. Errors encountered during examiner service installation are saved in the service install log in the %temp% folder.

9. When prompted to reboot, select to not reboot at this time.

10. Place copies of the EnLicense file in the following directories. These directory names will vary if you changed the default installation path.

• C:\Program Files (x86)\EnCase Applications\Examiner Service\EnCase32\License

• C:\Program Files (x86)\EnCase Applications\Examiner Service\EnCase64\License

11. Reboot the machine.

Verifying the installation

Verify the installation was successful by doing the following:

1. Verify the EnLicense is deployed to both 32 and 64-bit EnCase locations by navigating to the following locations:

• C:\Program Files (x86)\EnCase Applications\Examiner Service\EnCase32\License

• C:\Program Files (x86)\EnCase Applications\Examiner Service\EnCase64\License

2. If the current version of the EnLicense is not in these locations, you must find the license and copy it to these folders.

3. If you are not using a physical dongle, you must configure your NAS. Launch both the 32 and 64-bit versions of EnCase from the following locations:

• C:\Program Files (x86)\EnCase Applications\Examiner Service\EnCase32\EnCase.exe

• C:\Program Files (x86)\EnCase Applications\Examiner Service\EnCase64\EnCase.exe

• These directory names will vary if you changed the default installation path.

• For more information about configuring the NAS, please refer to the EnCase SAFE Administration Guide.

4. If the examiner service is installed on the same server where the Data Service is installed:

• Open the Examiner Service Configuration tool by navigating to Start Menu > All Programs > Examiner Service Configuration > Examiner Service Configuration V.5.x.

• Navigate to the SCM tab and check Service is dependent on World Wide Web Publishing Service.

5. Verify the examiner service is working and logged on by the correct user by opening Services from the Windows Control Panel.

6. From the Start menu, open the Control Panel and navigate to Administrative Tools > Event Viewer > Applications and Services Logs > ECC Examiner Service. Check your error messages and make any corrections necessary.

7. In Services, right click the Examiner Window Service to check its properties. In the Dependencies tab, verify that Windows Event Log is a dependent component.

In This Chapter

 Overview

 Configuring SMTP Connections

 Setting up a Mail Profile for HTTP Connections

 Setting up Web API Features

 Changing the Hostname of the Web Application

 Working with Encrypted Data

CHAPTER 4

Configuring EnCase