Notifications
Clear all
General (Technical, Procedural, Software, Hardware etc.)
12
Posts
6
Users
0
Reactions
3,648
Views
Topic starter
24/05/2009 5:28 am
Remember the message is from FTK Imager.
Not EnCase. So far, I have yet to use anything paid for (other than out of my own pocket), as there is "no justification and not needed". (Changing with the new lab described in other thread.)
The scenario is as follows
A internal HDD arrives at my highly secure location (cube).
single zip file on the drive.
It took me 2 days just to unzip all the .Enn files…
24/05/2009 12:48 pm
Open the last .enn file with a hex editor - within a few hundred bytes of the end of the file you will see either the plaintext word "next" or "done".
Next indictates there is another file that is missing - done inidicates that this is the last file.
Page 2 / 2
Prev