Hello everyone,
I'm using EnCase 6 and I'm facing serious problems
while data recovery of a formatted harddisk.
As the title suggests, I'm simply missing the
"recover folders" option, which should appear
judging by the user manual when I'm right-clicking
on the volume.
My practice up to this point is to start EnCase 6,
start a new case and after that I click on
"Add Device" and work through the menu.
Then the volume appears under "Entries".
While my research for this problem I've encountered a
which practically the same procedure is done with two differences
The "recover folders" option appears and it's EnCase 5, not 6…
I hope you can help me solving my problem. I guess the solution will
be pretty obvious and I simply don't see the forest for the trees…
The partition has to be correct and in place.
First of all, thank you for the quick answer.
But how do I do this ? I'm not aware of any mistake regarding the
circumstances and placement of the volume or how to solve it. By
the way, the volume is not devided into partitions, it's a whole harddisk.
You need to either manually add the partition or use the partition finder.
You need to either manually add the partition or use the partition finder.
Agreed. The process of finding folders differs depending upon whether the file system is FAT or NTFS. So the partition needs to be identified before the Recover Folders script can be executed.
EnCase provides a means of identifying possible partitions with the partition finder. But remember that if the system has been repartitioned, you may need to manually select what you consider to be the valid partition(s) before you attempt to recover the folders.
Some decisions EnCase cannot make for you.
The user manual makes clear that I need to use the filter pane for applying
the partition finder, but my filter pane is empty as you may see a bit on
the screenshot. Here's another one, it's completely empty…
And when I click on "filter pane" in the view tab, nothing happens.
How shall I access the partition finder module now ?
Thank you for your step-in, seanmcl, but doesn't EnCase already know
the partition ? When I added the device, the label column said "NTFS".
I'm not so worried about manually selecting the valid partitions, because
I'm having enough information for this in this case.
So apparently it seems, that everything is lacking in giving me the
choice for that.
Partition Finder is an enscript within Case Processor
Thank you for your step-in, seanmcl, but doesn't EnCase already know
the partition?
Gordon
One of the problems with a forum like this is that none of us can see what you see, even with screen shots.
As someone suggested, run the partition finder EnScript. But you may still need to decide which candidates identified by the EnScript are actual partitions and if the disk has been repartitioned, which I suspect, you may need to make some choices.
I would do it, but therefore the partition finder needs to run through and I don't see any opportunities to make the partition finder do this. As darren_q and the user manual say, the partition finder is part of the case processor Enscript Sample, which normally is in the filter pane, but how shall I access this, if my filter pane is empty, as I already explained ?
try going to absolute sector 0. in encase 6 this will be disk view in the top right pane. go to the very first block. click this block and then click the 'hex' button in the bottom left pane. right click in the hex area and click 'go-to'. type in '446'. highlight 446-510. when it is highlighted, right click and choose 'add partition'.
see if this works for you.