±Forensic Focus Partners

Become an advertising partner

±Your Account


Username
Password

Forgotten password/username?

Site Members:

New Today: 0 Overall: 36595
New Yesterday: 4 Visitors: 106

±Follow Forensic Focus

Forensic Focus Facebook PageForensic Focus on TwitterForensic Focus LinkedIn GroupForensic Focus YouTube Channel

RSS feeds: News Forums Articles

±Latest Articles

±Latest Videos

±Latest Jobs

Encase evidence files and Novastor tape backup

Forensic software discussion (commercial and open source/freeware). Strictly no advertising.
Reply to topicReply to topic Printer Friendly Page
Forum FAQSearchView unanswered posts
 
  

mark777
Senior Member
 

Encase evidence files and Novastor tape backup

Post Posted: Oct 31, 08 15:39

Just a warning for those using the Novastor tape backup software.

About six months ago our technician started using Novastor back up to put all out EnCase evidence files onto tape.

he has just left and I have had occassion since then to restore a job for further examination.

The drive image has failed (its useless) and I have discovered that when he backed it up the evidence file .EMF was not copied over onto the tape.

This is because the .EMF extension makes the computer think that it is a protected operating system file and by default the folder options are set for these to be hidden so NovaStor doesn't even see them to backup.


If you are using Novastore to backup you need to make sure that your computers folder options are set to "show hidden files and folders" (which the technician had done) AND the "Hide Protected Operating System files" box needs to be UNCHECKED (which he hadn't)


Hope no one else has been caught out.
_________________
Mark 
 
  

4n6art
Senior Member
 

Re: Encase evidence files and Novastor tape backup

Post Posted: Oct 31, 08 20:48

OUCH! I feel for you Mark!

Another reason why you should not only backup but test and validate that the backup works and has worked on a regular basis. Monthly tests of restoring a case to see if the backup/restore process is working should be part of the tech's duties.

I guess we live and learn... but thank you for the heads up.

Good luck!

-=Art=-  
 
  

mark777
Senior Member
 

Re: Encase evidence files and Novastor tape backup

Post Posted: Nov 01, 08 00:10

It was part of his duties. Say no more other than he has gone to other parts.

Too much trust maybe and an assumption someone can be bothered to do their job right. Like you say we live and learn.
_________________
Mark 
 

Page 1 of 1