As a side note, you should never run forensic software on the computer you are analyzing, you should mount the drive/image you are examining to a different computer and run the tools from the host computer that the drive/image is mounted to, this will help to preserve any data on the disk instead of possibly loosing data integrity by running a tool on the drive/image that you are investigating.
↧