Encase errors when ...
 
Notifications
Clear all

Encase errors when importing an L01 file with ADS

2 Posts
1 Users
0 Likes
1,162 Views
(@mbytescs)
Posts: 2
New Member
Topic starter
 

Running w/EnCase v8.08 and attempting to ingest an L01 containing ADS files from the CFREDS dataset. The ADS files are "expanded" meaning they were exported to the L01 with their file content.

So for example the file $Secure which has $Secure_$SDS as an alternate stream was written to the L01 as two files, $Secure @ 491.7KB and $Secure_$SDS @ 395.1KB.

When the L01 is imported into EnCase and then selected to display its content there are two error dialogs

The first is "Error loading evidence file", after clicking OK on that dialog and re-selecting the L01 a second dialog pops up,

"Error loading evidence file <name of L01> Device cache file size does not match". EnCase also shows "File Integrity - Unverified" in the Name-Value fields below.

Did some Googling for this error but nothing significant came up. I also didn't find anything in the forums here about this specific issue. I'm doing some forensics research w/EnCase and L01 files and I wanted to determine if this is possibly a bug in EnCase or that the L01 is somehow misformatted.

Hoping there may be someone in the forum from EnCase that may have a deeper understanding of the errors above and could shed some light.

 
Posted : 18/10/2019 1:43 pm
(@mbytescs)
Posts: 2
New Member
Topic starter
 

As these things usually go, you think you've unturned every rock before asking the question only to discover the problem after you've asked. Seems the L01 was indeed misformatted, once this was corrected EnCase was able to ingest the L01 and its contents could be viewed w/o error. Sorry for the post but perhaps it was part of the debug process anyway 😉

 
Posted : 18/10/2019 3:11 pm
Share: