Does anyone know which tool we could use in order to create E01 from the areas of the disk only?
I know when create L01 but would prefer E01
I know we could use FTK Lite and create AD images of the folders or areas and then would have to convert it into E01,
I’ve seen EnCase portable but I’m not very impressed as this is only executes pre-programmed Encripts but when you are on site you can expect everything and it is difficult to pre-determine what will be imaged.
Does Raptor support acquisition over the network? Perhaps we could run it on the laptop, connect to the network, and select the path (assuming it would bypass all security on the LAN), and image it. Has anyone tried that? 8)
E01 is a physical disk image and you want to do a logical file acquisition and an L01 would be the appropriate format.
You could use F-Response and FTK Imager over a network to do selected file acquisitions.
There are also the PinPoint Labs tools.