If "someone's" are sticklers about "Forensic Software platforms", I would take the AD1 with FTK Imager, and when you get back home you can export the files out. You get the appropriate metadata, and you can 'justify' FTK Imager, over XCOPY or COPY.
It's the "I read it on the airplane magazine" syndrome with the software requirements...
laughingman_nicoli wrote:
1. I'm on site and need to acquire one single file with all its meta data intact that resides on a virtual server in another state via a go-to meeting.
2. In my lab I have full EnCase to view the data later.
3. I have FTK Imager and I understand I can't view ad1's in EnCase. I have a good Robocopy script (though I tried this and it wasn't working I think do to the paths and such).
So, what are the options out there for acquiring single file/folders to view in EnCase?
↧