hai all,
i have imaged a hard disk using encase. now it has become necessary to prove the srl.no. of the hard disk imaged from the image disk. is it there any way to find out the srl.no.of the hard disk from the image. pl.advice.
thank u in advance,
krishna m
who is the manufacturer?
For Seagate or Maxtor mount the image and try their "
Or you can try USBDeview, and it should list the serial number.
Most of the info is under HKLM\SYSTEM\CurrentControlSet\Enum\
Greetings,
If you're using EnCase, and it was imaged with EnCase, the information should be available in the acquisition header. Select the disk in under the Entry tab and then select Report in the View pane. It should show a lot of information about the disk, including the disk's serial number.
Now I am curious if FTK will add that information to the header if it is creating an E01…..
-David
Hi Krishna
Not that this will help you for your current situation, but going forward it might….
Whenever I do imaging I try to get a photocopy of the drive label next to an index card with my case information on it. The index card has the case number, other pertinent information including evidence #, the computer it was removed from (make/model/sn) etc. The photocopy becomes part of my casefile.
I also try to put that in the notes field of the imaging software if I get the chance Something like
HD01 - Seagate Model##### 500GB, SATA, S/N removed from HP Evo xxxx, S/N xxxxx said to belong to Joe User.
Just an option going forward - you may find your own way that will work for you.
Good luck in this venture though.
-=Art=-
Should be with all the chain of custody and intake photos.