I was wondering if anyone with Encase experience would be able to explain to me how Encase deals with Drive allocation. I know that an imaged drive is not always displayed using the same drive allocation letter as the one it was using on the original machine (Having looked at the registry keys) and would be grateful if someone could explain if there is any system or if it simply just allocates a free letter on the machine your currently using?

Any help would be appreciated, Thanks  

Sarah,

I've read your question and I'm assuming that you mean the drive letter assignment in EnCase and not when EnCase is mounting the drive in Windows. If this is the case then EnCase will just start at 'C' (on a FAT or NTFS volume) and continue assigning drive letters from there.

If you have found information suggesting that EnCase's drive letter assignment is wrong you can change the drive letter/name by right-clicking on the letter and click on 'rename'. This should help to avoid complications.

hope this helped.
_________________
The views expressed by me do not reflect on my employer or the quality of work I produce
www.forensic4cast.com 

- DFICSI

If you have found information suggesting that EnCase's drive letter assignment is wrong

It usually is wrong, EnCase doesn't really do anything to determine what drive letters were assigned to what volume. For that you need to take a peek in the registry.  

Its for this reason I've asked/argued (along with others) on the EnCase boards for them to stop calling them C/D/E etc and call them 1 2 3 or something like that. It causes un-necessary confusion. The restore points usually have drive letter info in plain text as well for a quick glance at if you have any.