Encase evidence files and Novastor tape backup
Just a warning for those using the Novastor tape backup software.
About six months ago our technician started using Novastor back up to put all out EnCase evidence files onto tape.
he has just left and I have had occassion since then to restore a job for further examination.
The drive image has failed (its useless) and I have discovered that when he backed it up the evidence file .EMF was not copied over onto the tape.
This is because the .EMF extension makes the computer think that it is a protected operating system file and by default the folder options are set for these to be hidden so NovaStor doesn't even see them to backup.
If you are using Novastore to backup you need to make sure that your computers folder options are set to "show hidden files and folders" (which the technician had done) AND the "Hide Protected Operating System files" box needs to be UNCHECKED (which he hadn't)
Hope no one else has been caught out.
OUCH! I feel for you Mark!
Another reason why you should not only backup but test and validate that the backup works and has worked on a regular basis. Monthly tests of restoring a case to see if the backup/restore process is working should be part of the tech's duties.
I guess we live and learn… but thank you for the heads up.
It was part of his duties. Say no more other than he has gone to other parts.
Too much trust maybe and an assumption someone can be bothered to do their job right. Like you say we live and learn.