question when using Encase to image a HDD for the sake of restoring the image to a larger HDD. Basically moving an active OS to a new HDD and reinstalling it back in the machine for use.
when you create an E01 file and restore that to another HDD that's larger than the source, will the OS see the extended unallocated and know the drive is larger or will it treat it as if the drive is the same as the origional.
This is a MAC OS X 40GB HDD and need to move the data to a larger HDD. I know stuff like Ghost and other tools do this, but wanted to know how EnCase treated it.
much thanks!
EnCase will copy all the relevant sectors from the source evidence file (physical or logical depending on your choice) and gives you the option of wiping the remaining sectors on the target disk. Whether it boots up or not depends on a few factors, including the OS used so it may be a case of crossing your fingers!
Even when you get into your OS you'll likely have to use your favorite partitioning tool to be able to use the full disk capacity as the remainder will still be unused disk area.
The EnCase manual covers the process in detail and they apparently have a white paper called “Validation Testing of the EnCase Restore Process in Windows”.