Notifications
Clear all

Archiving FTK Cases

2 Posts
2 Users
0 Likes
365 Views
(@murdocha)
Posts: 9
Active Member
Topic starter
 

I'm looking to archive off some of our labs FTK 1.7 cases from our servers to make room for active projects.

The problem is that I do not want to archive the case, FTK index, and an Image file. Seems as though having an image file and an index is verging on duplication.

I presume that I can simply archive the relevant case files using explorer and if required re-index the case from the image and copy the archived files over the newly indexed case.

Am I correct in assuming this?

Before I investigate what I need from the FTK dir I was wondering if anyone had any experience and pointers.

Regards
HMM

 
Posted : 02/06/2008 3:32 pm
(@itagent2000)
Posts: 31
Eminent Member
 

You can delete the index and keep the case files and the evidence files,.

The evidence files themselves are really the very least you MUST keep, but then you will have to re-do all your work in case you need them again!

But you could also compress all files or only the evidence files and store them on a tape drive.

Regards Chris

 
Posted : 02/06/2008 5:03 pm
Share: