Notifications
Clear all
General (Technical, Procedural, Software, Hardware etc.)
11
Posts
5
Users
0
Reactions
1,986
Views
28/04/2010 9:57 am
we have been making a forensic copy of the original drive, decrypt the original, image the decrypted drive, and we are good to go. one could also restore a drive, bit it has to be as similar to the original as possible I believe
I think you meant to say decrypt the clone (copy). You should never decrypt the original drive. Decryption errors can occur and may require you to do it again. I know back before the integration with EnCase, if you were decrypting a Safeboot encrypted hard drive with the wrong decryption file you would hose your drive. Always decrypt a clone.
Page 2 / 2
Prev