We are running EnCase 8.08. Over 400 files in the image appear to be real files-they have meaningful names. Then have .docx and .xlsx extensions. EnCase reports their size as about 150Kb. They will not export normally, but we have forced them to export with manual techniques. The exported size is almost 200Mb, and both Word and Excel say they cannot be opened.
We've tried opening them with 7-zip as suggested in a thread on broken Excel files and recover text in Word. Neither worked.
Any help would be appreciated.
Hi,
What error are you getting when trying to export the files?
Also what “techniques” are you using to export them?
And is the size per file or total?
Regards
We tried using the File Exporter EnScript and got the message "hash is not minimum size".
We used EnCase's built in Results Copy and got the big files.
The contents of the exported files appear to be the same. We haven't checked all, but the ones we looked at do seem to have identical contents.
The files vary in size but are about 150K. Each of the exported ones are almost 10 times that.
Both Word and Excel cannot open them and return messages suggesting the file may be corrupted.
So are you copying the files from Results (Results Set) or Entries? and these are regular office documents, not deleted, nor data carved?
Have they been mounted as a compound file?
Also is this enscript one you got with EnCase or App Central?
Sorry for the questions, just trying to understand - since copying an office document should be as simple as Blue Check Select then Entries (or Results) and Copy Files….
Also the enscript mentioned doesn't ring any bells, is there a fuller name or is it just File Exporter….
yikes! Turns out no one tried exporting from entries. File Exporter worked fine & everything exported properly. Talk about a rookie mistake! Thanks for the responses, they triggered our brains in the right direction.
Excellent, i’m pleased they exported ok…
Regards