Notifications
Clear all

Compression

4 Posts
4 Users
0 Likes
377 Views
(@tmy880)
Posts: 23
Eminent Member
Topic starter
 

Is there anyway to compress an evidence file from EnCase after it is aquired to send to a server for space saving purposes.

Example Aquire an image if a HD using no compression. After case is finished compress the image and save to server.

Thanks

 
Posted : 24/04/2009 12:14 am
(@kovar)
Posts: 805
Prominent Member
 

Greetings,

You can reacquire the evidence file. The instructions for this can be found on page 221 of the EnCase User's Guide for 6.13.

Quoting from that source

Before you begin

- EnCase is open
- The file to be reacquired is included in the case
- The case is open

In the Tree pane, click Cases->Entries->Home.
The Entries tree displays in the Tree pane.
2. Right click the device to be reacquired, and click Acquire.
The After Acquisition page of the Acquisition wizard displays.
3. Perform the acquisition (see Specifying and Running an Acquisition).
4. Pay particular attention to the disposition of the file
a. Use the New Image File controls on the After Acquisition page.
b. Click Quick Reacquisition on the Options page of the Wizard.

You can change the compression level while doing the reacquisition.

-David

 
Posted : 24/04/2009 12:23 am
bshavers
(@bshavers)
Posts: 210
Estimable Member
 

FTK Imager.
1) Create Disk Image
2) Select Source (your image)
3) Choose your destination
4) Select image type, compression level
5) That's it.

 
Posted : 24/04/2009 3:13 am
(@ronanmagee)
Posts: 145
Estimable Member
 

We've found that good compression offers a good saving in relation to size vs time where as best compression is only marginally better than good but takes much longer to run.

See here for more details.

 
Posted : 24/04/2009 3:51 am
Share: