Is there anyway to compress an evidence file from EnCase after it is aquired to send to a server for space saving purposes.
Example Aquire an image if a HD using no compression. After case is finished compress the image and save to server.
Thanks
Greetings,
You can reacquire the evidence file. The instructions for this can be found on page 221 of the EnCase User's Guide for 6.13.
Quoting from that source
Before you begin
- EnCase is open
- The file to be reacquired is included in the case
- The case is open
In the Tree pane, click Cases->Entries->Home.
The Entries tree displays in the Tree pane.
2. Right click the device to be reacquired, and click Acquire.
The After Acquisition page of the Acquisition wizard displays.
3. Perform the acquisition (see Specifying and Running an Acquisition).
4. Pay particular attention to the disposition of the file
a. Use the New Image File controls on the After Acquisition page.
b. Click Quick Reacquisition on the Options page of the Wizard.
–
You can change the compression level while doing the reacquisition.
-David
FTK Imager.
1) Create Disk Image
2) Select Source (your image)
3) Choose your destination
4) Select image type, compression level
5) That's it.
We've found that good compression offers a good saving in relation to size vs time where as best compression is only marginally better than good but takes much longer to run.
See here for more details.