EnCase Long File Pa...
 
Notifications
Clear all

EnCase Long File Path Problem

12 Posts
9 Users
0 Likes
1,218 Views
(@muirner)
Posts: 65
Trusted Member
Topic starter
 

I'm attempting to extract an image that was made using FTK Imager using the .E01 format. When I extract the image i have a few problems. Let me describe this the best I can
I green plate the drive, and run the condition.
I click on the view pane and hit ctrl + space to select all files that met my condition.
Right click on the drive, and click copy folders.
Let the extraction commence
After it has processed I get the box with the info about the extraction. I have almost 200 errors. So i click the check box next to console and send it there. Then I examine the console screen.

Here is what i'm observing
- The folder structure is all messed up. There is no program files on the root of C\ . The program files folder has been moved into Application Data.
- WINNT folder is inside of C\documents and settings\user\program files\ibm\WINNT
-
- Most of the files that are erroring are coming from the same folder.
o I drive down further into the folder structure and try to extract at the lower level to work around the long file path error I’m getting. When I extract at the lower level and try to robocopy the extracted folders onto the destination drive (where they previously errored) the structure is so different it’s difficult to place them in the right spot (seeing how now there is no program files folder on the root.
Has anyone seen the program files get moved like this? EnCase is version 6.15, FTK imager is 2.6.1.62. Also does anyone know of a work around for the long file path problems I’m having. I was told by guidance that they want to implement Robocopy but they don’t know when/if it will happen any time soon. I found an EnScript but the problem is that it only finds long file names not long file paths.
Regards
Muirner

 
Posted : 06/04/2010 12:56 am
(@mmachor)
Posts: 70
Trusted Member
 

Working in E-Discovery / Forensics we ran into the same problems. I'm not sure on a solution, but we went back to using EnCase 6.13. Had found other bugs in the 6.15 version as well.

 
Posted : 06/04/2010 6:09 am
(@muirner)
Posts: 65
Trusted Member
Topic starter
 

What sort of bugs have you found in 6.15?? Also it's funny that 6.16 was released and then retracted within a day or two because of "problems found in the program." It'd be nice to have more details about the said problem. At least then we'd know if the processes that we are running are going to be suseptable to problems during processing and take the proper actions to negate the problems caused by 6.15/.16

 
Posted : 06/04/2010 6:35 pm
(@ctaylor)
Posts: 27
Eminent Member
 

In regards to the EnCase problem that caused 6.16 to be pulled, from what I understand in reading and following up on the Guidance boards, several users reported that after they installed 6.16, they could not access their drives from within the program. Tech Support was able to replicate this, and pulled the release.

I'm sure there were other "undocumented program features" that they were attempting to fix with that release. I was midway though downloading when they pulled the files. Hope that helps.

Chris

 
Posted : 06/04/2010 8:18 pm
(@muirner)
Posts: 65
Trusted Member
Topic starter
 

Chris,

Thanks, that does help. Call me overly paranoid but for some reason whenever I hear of problems big enough to compramise a release and ultimatly pull it I get very nervous. Immediatly I get worried that there will be some sort of issue that could cause issues during litigation.

Now to try to find a solution for Long File Path issues, as i'm running into a good amount of problems.

 
Posted : 06/04/2010 8:32 pm
(@tmy880)
Posts: 23
Eminent Member
 

FYI Encase 6.16.1 was released on 4/6/10.

 
Posted : 15/04/2010 9:42 pm
(@muirner)
Posts: 65
Trusted Member
Topic starter
 

I did see that. Thank you. As far as I know this one still doesn't have robocopy built into it to allow for long file paths, and long file names… I'll verify in the change log.

 
Posted : 15/04/2010 10:25 pm
(@davemeyers)
Posts: 3
New Member
 

We too have experienced this isse with long file paths.

In my case, I was able to omit the 2 fiels that were causing the issue and everything exported just fine, then I had to go back and manually extract the 2 files into a shorter path.

I have not been able to find any relavent information on this.

We are using Encase 6.15 at this time.

The issue was the same in that the rest of the folders are extracted into a folder close to where the error happens.

 
Posted : 15/04/2010 11:54 pm
(@jonstewart)
Posts: 47
Eminent Member
 

I wrote a script a long time ago to export files from EnCase, and it's able to deal with illegal characters, duplicate paths, and long paths. There are a lot of options and I won't go so far as to vouch that all of them are in perfect working order, but it will probably do the job. It's not officially support by GSI or by myself, so please be sure to validate its results.

The name of the script is "Copy Folders with Report" and it's available as an EnPack from the GSI support portal, under the EnScript Resource Center, I believe.

Jon

 
Posted : 13/07/2010 9:18 pm
(@ricktor)
Posts: 1
New Member
 

thanks for the info.,you could also try long path tool. it helped me with error 1320 in Win 7.,)

 
Posted : 29/05/2013 2:13 pm
Page 1 / 2
Share: