Notifications
Clear all

Encase Imaging

7 Posts
5 Users
0 Likes
613 Views
Webbie
(@webbie)
Posts: 29
Eminent Member
Topic starter
 

Has anyone heared of any problems regarding image discrepencies using Encase Ver 3.22 or Encase Ver 4.19a ?

 
Posted : 15/12/2006 1:39 pm
(@steve_m)
Posts: 4
New Member
 

Paul
I am dealing with a case where an imaging issue has arisen and apparently the same physical drive has produced two different but verified hash values.

As this is an ongoing case I am not at liberty to discuss this in open forum. If you wish top discuss this on a one to one basis please Email me your contact no. via enquiries@dataforensics.ltd.uk.

Regards

Steve

 
Posted : 15/12/2006 2:46 pm
steve862
(@steve862)
Posts: 194
Estimable Member
 

Hi,

When it comes to imaging with EnCase in Windows you need to bear in mind that it is relying upon Windows to a degree to detect the drive and partitions correctly. Using an EnCase boot disk and acquiring outside of Windows would be the next move if you have discrepancies. Alternatively acquiring an image using another method such as dd from a linux computer would also be desirable.

Steve

 
Posted : 15/12/2006 6:22 pm
(@chrisprickaerts)
Posts: 8
Active Member
 

Hi,

Keep in mind that when you acquire under DOS it's best to use the version equivalent of the Windows version of Encase you are using.

Another option is to use Linen, it's available under Helix

I do assume you are using a write blocker when imaging under Windows?
(just checking)

 
Posted : 15/12/2006 7:37 pm
Webbie
(@webbie)
Posts: 29
Eminent Member
Topic starter
 

Hi,

I do assume you are using a write blocker when imaging under Windows?
(just checking)

Yes, both Fastbloc and Tableau write blockers.
I understand there are alternative methods to image, but I'm specifically intrested in Encase.

 
Posted : 16/12/2006 12:02 am
(@chrisprickaerts)
Posts: 8
Active Member
 

Hi Webbie,

What kind of discrepancies are you experiencing?

Regards,

Chris

 
Posted : 18/12/2006 1:07 pm
(@rich2005)
Posts: 535
Honorable Member
 

Are you referring to this https://messageboards.guidancesoftware.com/showthread.php?t=28963

 
Posted : 16/02/2007 3:30 pm
Share: