±Forensic Focus Partners

Become an advertising partner

±Your Account


Forgotten password/username?

Site Members:

New Today: 0 Overall: 36312
New Yesterday: 0 Visitors: 200

±Follow Forensic Focus

Forensic Focus Facebook PageForensic Focus on TwitterForensic Focus LinkedIn GroupForensic Focus YouTube Channel

RSS feeds: News Forums Articles

±Latest Articles

±Latest Videos

±Latest Jobs

Encase question

Forensic software discussion (commercial and open source/freeware). Strictly no advertising.
Reply to topicReply to topic Printer Friendly Page
Forum FAQSearchView unanswered posts
Page Previous  1, 2 

Senior Member

Re: Encase question

Post Posted: May 05, 08 23:13

In that category comes "Why didn't you photograph the evidence?" Specifically, I received a Dell laptop with an internal hard drive. The drive had both a Toshiba and a Dell part number on it and I imaged it using EnCase. Since EnCase versions before 6 did not capture the drive serial number, I noted it on my log. Dell cannot identify by serial number what drives are shipped with what systems so I could only confirm that this was the original using circumstantial evidence and the testimony of the computer owner/user.

Opposing counsel wanted to know why I didn't photograph the drive and the computer so that the drive serial number and the computer serial number appeared simultaneously in the same picture? I pointed out that in ordfer to get the drive serial number I would have to remove it from the computer and, at that point, since it could be any drive appearing in the same picture, why was this "better" than my testimony and written records?

Unfortunately, truth sometimes takes a back seat to legal posturing.  

Page 2 of 2
Page Previous  1, 2