Notifications
Clear all

EnCase media types

4 Posts
3 Users
0 Reactions
554 Views
 dirk
(@dirk)
Eminent Member
Joined: 20 years ago
Posts: 25
Topic starter  

Hi all.

I can see from documentation (e.g. here) the meaning of 5 of the possible values for the EnCase media type.

However, I have also seen 0x05 in some physical images and 0x0D in some logical images.

Is there any documentation pointing to the meaning of those? (Or does anyone know the answer themselves?)


   
Quote
 dirk
(@dirk)
Eminent Member
Joined: 20 years ago
Posts: 25
Topic starter  

Nobody? /


   
ReplyQuote
(@kovar)
Prominent Member
Joined: 18 years ago
Posts: 805
 

Greetings,

Have you written to the author of the document?

What tools created the images that do not conform to the spec?

-David


   
ReplyQuote
binarybod
(@binarybod)
Reputable Member
Joined: 17 years ago
Posts: 272
 

If you open the image in EnCase then when you highlight the root entry in report view it will give you the 'Drive Type'

This is a typical reverse engineering problem and not something that Joachim will have documented if he's never encountered it (though he may have, and as kovar suggests, it wouldn't hurt to ask)

Paul


   
ReplyQuote
Share: