Manual Parsing for ...
 
Notifications
Clear all

Manual Parsing for Drive Letters in EnCase Forensic 8.07  

  RSS
DrTobiasFunke
(@drtobiasfunke)
New Member

I can't seem to remember how to do this. What is the manual procedure for determining a drive letter within EnCase. I seem to remember the process involving LNK files and something else. EnCase Forensic doesn't assign the correct drive letters and I need to remember how to do this manually without an EnScript. Can someone remind me please? Thanks. 

Quote
Posted : 13/09/2020 6:40 pm
pbobby
(@pbobby)
Active Member

Right click whatever the assigned drive letter is and 'rename'.

How to determine what that drive letter should be? That's forensics! But yes, using LNK files is often the easiest method.

ReplyQuote
Posted : 14/09/2020 12:23 pm
jaclaz
(@jaclaz)
Community Legend

Registry: HKEY_LOCAL_MACHINE\SYSTEM\MountedDevices ?

jaclaz

ReplyQuote
Posted : 14/09/2020 7:07 pm
Share: