Hi All,
Recently i have started using Encase v8, everything looks good but my only biggest concern is i am not able to create L01 file of a zip and other files together.
Suppose i have 1 zip file and 1 pst file. Now i mount the zip file either by using view file structure or Evidence processor.
Now when i am trying to create a L01 file of the mounted zip and the pst i am only getting 2 files, although my requirement is i should get 1 pst and the mounted zip file contents.
This same process can be easily done in Encase 6.
Can someone who has used Encase v8, please suggest me a solution so that i can create L01 image of both pst and mounted zip file contents in the L01 image.
Thanks.
One thing you can try is create one at a time. Blue check the ZIP file, create the L01. Then uncheck it. Blue check the PST and create an L01 of that.
I know it seems like using 2 steps in a process that should only be one step, but whatever is checked at the time of the L01 creation, that is what will be in it.
Thank you for the response i tried all the possible combinations of checking and unchecking the files but it seems nothing works with the zip file.
I was hoping if someone knows the turn around to work out the things.