±Forensic Focus Partners

Become an advertising partner

±Your Account


Username
Password

Forgotten password/username?

Site Members:

New Today: 0 Overall: 36583
New Yesterday: 6 Visitors: 143

±Follow Forensic Focus

Forensic Focus Facebook PageForensic Focus on TwitterForensic Focus LinkedIn GroupForensic Focus YouTube Channel

RSS feeds: News Forums Articles

±Latest Articles

±Latest Videos

±Latest Jobs

Dealing with very large amounts of data

Computer forensics discussion. Please ensure that your post is not better suited to one of the forums below (if it is, please post it there instead!)
Reply to topicReply to topic Printer Friendly Page
Forum FAQSearchView unanswered posts
Page Previous  1, 2 
  

PaulSanderson
Senior Member
 

Re: Dealing with very large amounts of data

Post Posted: Mar 18, 09 16:57

- DFICSI
Beware of the problems with mounting as a network share in EnCase. It has been reported that the first 4GB are copy over and over so you only ever see the information from the fist 4GB.


More info here www/sandersonforensics.com/Files/Encase%20mounted%20wrap%20bug.pdf

Just checked this in the latest 64 bit version of EnCase and it seems OK - not sure when it was fixed although I know it took well over a year.
_________________
Paul Sanderson
SQLite Forensics Book
www.amazon.com/SQLite-...entries*=0

Forensic Toolkit for SQLite
sandersonforensics.com...for-SQLite 
 
  

Ivalen
Member
 

Re: Dealing with very large amounts of data

Post Posted: Mar 19, 09 03:32

This bug has been fixed.

And lest people assume the wrong idea - the problem was with single files >= 4gigs, not just 4gigs of data in general.  
 

Page 2 of 2
Page Previous  1, 2