I have my forensic image stored on the server. However, quite often, EnCase will get disconnected from the evidence file. The connection to the server appears fine, as I don't notice any disconnections or hiccups while doing other activities (Explorer, FTK Imager, etc). If this is a network issue, this truly is the only symptom that I have noticed.
Guidance says its the network.
I tried doing ping overnight, but it showed no packet loss. Unfortunately, that is about the extent of my network-fu.
Has anyone else had this problem? Does anyone know of a better way to test the network?
At the risk of defending Guidance, I would agree it sounds more likely to be a network/OS issue rather than EnCase (I certainly haven't experienced the problem over my years of using it).
The only thing that strikes me is I remember having one (EnCase unrelated issue) with large file transfers to/from a Windows server, that was resolved with registry modifications. (I'd be more specific if I could remember enough about the issue to google it - this probably isn't helpful!)
What you could do, perhaps, is to connect another desktop of yours via a short network crossover, with the same image on that desktop, and repeat your EnCase process over that network cable, to see if you still have the problems. If not it would certainly seem to rule out EnCase to some degree and more squarely point the finger at the network/OS.
Rich
Thank you for that. If I can russle up a computer not already in use, I shall try that.
I am sure it is my machine as well. So, when I get back I'm going to try a few other things. I am looking for other ideas on how to stress test the network. (mostly for education, rather than realistic troubleshooting).