Manual Parsing for ...
 
Notifications
Clear all

Manual Parsing for Drive Letters in EnCase Forensic 8.07

3 Posts
3 Users
0 Likes
1,050 Views
DrTobiasFunke
(@drtobiasfunke)
Posts: 1
New Member
Topic starter
 

I can't seem to remember how to do this. What is the manual procedure for determining a drive letter within EnCase. I seem to remember the process involving LNK files and something else. EnCase Forensic doesn't assign the correct drive letters and I need to remember how to do this manually without an EnScript. Can someone remind me please? Thanks. 

 
Posted : 13/09/2020 5:40 pm
pbobby
(@pbobby)
Posts: 239
Estimable Member
 

Right click whatever the assigned drive letter is and 'rename'.

How to determine what that drive letter should be? That's forensics! But yes, using LNK files is often the easiest method.

 
Posted : 14/09/2020 11:23 am
jaclaz
(@jaclaz)
Posts: 5133
Illustrious Member
 

Registry: HKEY_LOCAL_MACHINE\SYSTEM\MountedDevices ?

jaclaz

 
Posted : 14/09/2020 6:07 pm
Share: