Hello everyone,
With this message I'd like to know your opinion about which of the three most common forensic imaging formats should be used. I know there is not an absolute answer for this, but I would like to know your opinion.
Relating to me, I've always used EnCase (EWF), but merely because it is also my analysis tool. However, I've began reading in some papers that the best one could be the "raw" format provided by dd, since it allows a higher analysis flexibility.
What do you think about this?
Check this link - http//www.forensicfocus.com/index.php?name=Surveys&op=results&pollid=5
If you search this board, you'll find this has been discussed at length.
Andy
Isn't that link just a poll? I can't see any comments, sorry S
Hi Iruiper,
Andy is right, this subject has been discussed at length but I cannot find the original posts. The answer in my view would be to use raw format as it is compatible with all the major forensic tools. Proprietary formats come and go and there could be compatibility issues in future releases of the software.
Alan
Here's the one I was thinking of http//www.forensicfocus.com/index.php?name=Forums&file=viewtopic&t=557&postdays=0&postorder=asc&start=0
I have just added a post to the link posted by Andy