So a little background first:
I work at an IT-Security firm that currently doesn't handle forensic cases but me and a senior collegue have been tasked to handle a case from a customer. The reason I was one of the people assigned to the case is because I took some forensic classes when I studied for my Bsc and I do some work on my spare time, mostly with volatility as well as trying out a few challenges here and there.
To the problem:
The company has an Old Tableu TD1 and Encase 6 that we used to duplicate an external 1TB USB drive after removing the case using fat32 and splitting the clone into several E01 files. We duplicated the disk to an ordinary 3TB data disk that when put in a HDD bay and connected to my W8 laptop that failed to recognize the filesystem and refused to letting me have access to the disk. I tried acquring the physical disk through Encase. This worlds but just gave me access to the disk clone file structure (including the E01 files) but not the disk that was cloned, is this possible in any way?
Well after trying back and forth with for a while with no progress, we connected the HDD bay to my collegues Mac and it actually found the filesystem, and we copied all the E01 files to another USB-drive and finally to my laptop with Encase on it.
After this we fired up Encase and dragged the first E01 file into Encase, now the file is is visible as an image in Encase named IMAGE, but I can't seem to access the file structure.
So my question is, where have I gone wrong, why can't I access the file system? Was it because I just copied the E01 files from the disk clone or could it be something else?
I have previous experience with working Encase, but all cases I've done I've just been handed or downloaded an image to work with.
Sorry for all the spelling and formatting mistakes as I'm currently on my phone.
Any help and input appreciated.
↧