±Forensic Focus Partners

Become an advertising partner

±Your Account


Username
Password

Forgotten password/username?

Site Members:

New Today: 0 Overall: 34595
New Yesterday: 0 Visitors: 225

±Follow Forensic Focus

Forensic Focus Facebook PageForensic Focus on TwitterForensic Focus LinkedIn GroupForensic Focus YouTube Channel

RSS feeds: News Forums Articles

±Latest Articles

±Latest Webinars

Archiving FTK Cases

Forensic software discussion (commercial and open source/freeware). Strictly no advertising.
Reply to topicReply to topic Printer Friendly Page
Forum FAQSearchView unanswered posts
 
  

Archiving FTK Cases

Post Posted: Mon Jun 02, 2008 9:32 am

I'm looking to archive off some of our labs FTK 1.7 cases from our servers to make room for active projects.

The problem is that I do not want to archive the case, FTK index, and an Image file. Seems as though having an image file and an index is verging on duplication.

I presume that I can simply archive the relevant case files using explorer and if required re-index the case from the image and copy the archived files over the newly indexed case.

Am I correct in assuming this?

Before I investigate what I need from the FTK dir I was wondering if anyone had any experience and pointers.

Regards
HMM  

murdocha
Member
 
 
  

Re: Archiving FTK Cases

Post Posted: Mon Jun 02, 2008 11:03 am

You can delete the index and keep the case files and the evidence files,.

The evidence files themselves are really the very least you MUST keep, but then you will have to re-do all your work in case you need them again!

But you could also compress all files or only the evidence files and store them on a tape drive.

Regards Chris  

itagent2000
Member
 
 

Page 1 of 1