Has anyone heared of any problems regarding image discrepencies using Encase Ver 3.22 or Encase Ver 4.19a ?
Paul
I am dealing with a case where an imaging issue has arisen and apparently the same physical drive has produced two different but verified hash values.
As this is an ongoing case I am not at liberty to discuss this in open forum. If you wish top discuss this on a one to one basis please Email me your contact no. via enquiries@dataforensics.ltd.uk.
Regards
Steve
Hi,
When it comes to imaging with EnCase in Windows you need to bear in mind that it is relying upon Windows to a degree to detect the drive and partitions correctly. Using an EnCase boot disk and acquiring outside of Windows would be the next move if you have discrepancies. Alternatively acquiring an image using another method such as dd from a linux computer would also be desirable.
Steve
Hi,
Keep in mind that when you acquire under DOS it's best to use the version equivalent of the Windows version of Encase you are using.
Another option is to use Linen, it's available under Helix
I do assume you are using a write blocker when imaging under Windows?
(just checking)
Hi,
I do assume you are using a write blocker when imaging under Windows?
(just checking)
Yes, both Fastbloc and Tableau write blockers.
I understand there are alternative methods to image, but I'm specifically intrested in Encase.
Hi Webbie,
What kind of discrepancies are you experiencing?
Regards,
Chris
Are you referring to this https://