dagardc wrote:
Anyone know if there are any limitations for Encase v5 with modern Windows images? I have many extra dongles that we never upgraded and wanted to know if they could still be used by my eDiscovery group for basic tasks such as exporting files from images and creating file listings.
EnCase didn't (and as far as I am aware still doesn't) natively support files in volume shadow copies. If you need to look at these with EnCase you need to mount each shadow as a drive letter and add it as a logical volume - slow, a pita and a real problem if you have more than a handful - the most I am aware of is 111 shadows!
plug- Reconnoitre (I am the author) was designed to support VSCs - happy to provide a fully functional demo if you'd like a copy.
↧