Notifications
Clear all
Topic starter
15/10/2009 1:49 pm
So, my new employer uses all the three major forensic tools FTK, EnCase and ILook PI. It's been a while since I did forensics and I now have an ILook PI image (.ASB) I'd like to play around with. Is there any way I can get this image loaded into EnCase and FTK? Either directly or by means of conversion?
Stigster
15/10/2009 3:19 pm
I used to deal with ILook images a lot. You need to load the ILook imager (think its called IXImager or something like that) and convert the .asb files to raw bitstream. Once you have done this you can add the disk as a raw image.
Hope this helps.
Topic starter
15/10/2009 3:35 pm
Great! Thanks. I'll give it a try. )