±Forensic Focus Partners

Become an advertising partner

±Your Account


Forgotten password/username?

Site Members:

New Today: 0 Overall: 36583
New Yesterday: 6 Visitors: 143

±Follow Forensic Focus

Forensic Focus Facebook PageForensic Focus on TwitterForensic Focus LinkedIn GroupForensic Focus YouTube Channel

RSS feeds: News Forums Articles

±Latest Articles

±Latest Videos

±Latest Jobs

Dealing with very large amounts of data

Computer forensics discussion. Please ensure that your post is not better suited to one of the forums below (if it is, please post it there instead!)
Reply to topicReply to topic Printer Friendly Page
Forum FAQSearchView unanswered posts
Page Previous  1, 2 

Senior Member

Re: Dealing with very large amounts of data

Post Posted: Mar 18, 09 16:57

Beware of the problems with mounting as a network share in EnCase. It has been reported that the first 4GB are copy over and over so you only ever see the information from the fist 4GB.

More info here www/sandersonforensics.com/Files/Encase%20mounted%20wrap%20bug.pdf

Just checked this in the latest 64 bit version of EnCase and it seems OK - not sure when it was fixed although I know it took well over a year.
Paul Sanderson
SQLite Forensics Book

Forensic Toolkit for SQLite


Re: Dealing with very large amounts of data

Post Posted: Mar 19, 09 03:32

This bug has been fixed.

And lest people assume the wrong idea - the problem was with single files >= 4gigs, not just 4gigs of data in general.  

Page 2 of 2
Page Previous  1, 2