±Forensic Focus Partners

Become an advertising partner

±Your Account


Username
Password

Forgotten password/username?

Site Members:

New Today: 0 Overall: 36775
New Yesterday: 3 Visitors: 89

±Follow Forensic Focus

Forensic Focus Facebook PageForensic Focus on TwitterForensic Focus LinkedIn GroupForensic Focus YouTube Channel

RSS feeds: News Forums Articles

±Latest Articles

±Latest Videos

±Latest Jobs

Encase Carving

Computer forensics discussion. Please ensure that your post is not better suited to one of the forums below (if it is, please post it there instead!)
Reply to topicReply to topic Printer Friendly Page
Forum FAQSearchView unanswered posts
Page 1, 2  Next 
  

gremodic
Member
 

Encase Carving

Post Posted: Mar 22, 10 15:24

Hi to all,
i have a problem.... i have a CD-Rom acquired with encase 6.15 now when i analyze this image or analyze directly the CD-Rom i see only unallocated cluster, but i know for sure that there is an mpg file, i'm sure because foremost and isobuster have found this file, now i have tried with case processor and the other way you have write before but i don't found nothing......what can i do to find this file with encase??  
 
  

Rich2005
Senior Member
 

Re: Encase Carving

Post Posted: Mar 22, 10 17:18

Its probably EnCase being rubbish at parsing the particular filesystem you have on the disc. Its particularly bad at UDF from memory.
(I've requested much better support but that's probably scheduled for 2020 some time).
What are you trying to do particularly with EnCase? Is there a reason you can't report using a different tool? (such as IsoBuster as you say)
Is it a CDR or CDRW?  
 
  

gremodic
Member
 

Re: Encase Carving

Post Posted: Mar 23, 10 17:56

It's 1 CD-R and 1 DVD-RW, no no i can use the other product but mine is a simple curiosity about encase....you know how much cost encase and so i was surprised of this situation...and for be sure from now to analyze cd e dvd with other tools and not with encase...  
 
  

benfindlay
Senior Member
 

Re: Encase Carving

Post Posted: Mar 23, 10 18:03

Sounds like when you added it to EnCase you haven't added it as a raw image.

You can sort this by choosing File >> Add Raw Image, specify that its a CD-ROM, and right click in the components box to add the path to the file in question. Oh, and don't forget to fill in a name for the exhibit!

That work?  
 
  

gremodic
Member
 

Re: Encase Carving

Post Posted: Mar 23, 10 18:09

I have this problem also if i don't add an image but add directly the cd-rom...is the same ...by the way i try what you say but without results  
 
  

benfindlay
Senior Member
 

Re: Encase Carving

Post Posted: Mar 23, 10 18:15

In which case, has EnCase reverted to Acquisition mode? Look in the menu bar; if the word Acquisition is present, EnCase has lost contact with your dongle. If so, take the dongle out, reconnect it and restart EnCase.

Hope this helps  
 
  

gremodic
Member
 

Re: Encase Carving

Post Posted: Mar 23, 10 18:30

i undesrtand what you say but it isn't a dongle problem i have tried to analyze image with other tools and its ok....with encase no i have tried to add the E01 file as a normal encase and as a raw image  
 

Page 1 of 2
Page 1, 2  Next