±Forensic Focus Partners

±Your Account


Nickname
Password


Forgotten password/username?


Membership:
New Today: 0
New Yesterday: 1
Overall: 27354
Visitors: 53

±Follow Forensic Focus

Join our LinkedIn group

Subscribe to news

Subscribe to forums

Subscribe to blog

Subscribe to tweets

Question on Encase Drive Letter Assignment

Forensic software discussion (commercial and open source/freeware). Strictly no advertising.
Reply to topicReply to topic Printer Friendly Page
Forum FAQSearchView unanswered posts
 
  

Question on Encase Drive Letter Assignment

Post Posted: Sun Oct 05, 2008 5:25 am

I was wondering if anyone with Encase experience would be able to explain to me how Encase deals with Drive allocation. I know that an imaged drive is not always displayed using the same drive allocation letter as the one it was using on the original machine (Having looked at the registry keys) and would be grateful if someone could explain if there is any system or if it simply just allocates a free letter on the machine your currently using?

Any help would be appreciated, Thanks Smile  

SarahM
Newbie
 
 
  

Re: Question on Encase Drive Letter Assignment

Post Posted: Sun Oct 05, 2008 10:47 am

Sarah,

I've read your question and I'm assuming that you mean the drive letter assignment in EnCase and not when EnCase is mounting the drive in Windows. If this is the case then EnCase will just start at 'C' (on a FAT or NTFS volume) and continue assigning drive letters from there.

If you have found information suggesting that EnCase's drive letter assignment is wrong you can change the drive letter/name by right-clicking on the letter and click on 'rename'. This should help to avoid complications.

hope this helped.
_________________
The views expressed by me do not reflect on my employer or the quality of work I produce Wink
www.forensic4cast.com 

DFICSI
Senior Member
 
 
  

Re: Question on Encase Drive Letter Assignment

Post Posted: Tue Oct 21, 2008 3:55 pm

- DFICSI
If you have found information suggesting that EnCase's drive letter assignment is wrong
It usually is wrong, EnCase doesn't really do anything to determine what drive letters were assigned to what volume. For that you need to take a peek in the registry.  

echo6
Senior Member
 
 
  

Re: Question on Encase Drive Letter Assignment

Post Posted: Wed Oct 22, 2008 5:45 am

Its for this reason I've asked/argued (along with others) on the EnCase boards for them to stop calling them C/D/E etc and call them 1 2 3 or something like that. It causes un-necessary confusion. The restore points usually have drive letter info in plain text as well for a quick glance at if you have any.  

Rich2005
Senior Member
 
 
Reply to topicReply to topic

Share this forum topic to encourage more replies



Page 1 of 1