Hi all,
I am having an issue, i did the acquisition procedure with LINEN v.6.14, the hard disk was encrypted, and the customer has give to me the .sdb file (safeboot) to can decrypt the acquisition image and to can access to it.
My problem is when i try to access with this sdb key, the error is that when i add the acquisition and the .sdb i only see "Unallocated Clusters" and no more data is contained in the image. Could the problem be the sdb. file, that this .sdb isn´t correct for the user that is working in the machine??
we have done the same procedure with another company computer and we work correctly with the acquisition but with the first one we cann´t access to image or we don´t see any information.
I hope you can help me.
Thanks a lot. Regards
Jesus
Are you using EnCase with EDS?
Does the apparant 'unallocated clusters' still appear to be ciphered?
Dan
Yes, i am using it.
And the acquisition appears to be cyphered after using the sdb file, i think that the issue could be that the sdb file isn´t correct for that user.
How can i add an image?? i don´t see any bottom to add an image…
Regards
Jesus
Are you being prompted for the Safeboot information when you add the image in EnCase? Also what version of Safeboot was the computer you acquired running? And for that matter what version of EnCase are you running?
Tom