Hi All,
Guyz I just imaged/acquired 80GB hard disk with ILOOK imager and I want to preview the image of that hard disk with EnCase V5, how do I do that cause i tried previewing the image with EnCase but i just could'nt….Would some body pls help me out with this problem….ASAP!
Thanx,
Socks ) .
South Africa.
From the ILook FAQ
ILook Default Image Format (IDIF)
ILook Raw Bitstream Format (IRBF)
ILook Encrypted Image Format (IEIF)
NOTE All three image formats listed above are proprietary to ILook and can be subsequently converted to raw bitstream format using IXimager. Once converted to raw bitstream format, the image files can then be used by other forensic software.
Socks,
You might also want to read up on ILook's imaging process. I "heard" from a friend in the industry that there was errors found in the way ILook images. I DID NOT verify this information, but it might be something you want to search for. I hate to be the one to spread rumors, but the source was reliable. I will ask him about it this week and see if I can post what he was referring to.
Since there a lot of non LE people on this forum, I fear that your help with I-Look could be pretty limited. sorry….
Socks
This is something you should discuss on the iLook list.