Quantcast
Channel: Forensic Focus Forums - Recent Topics
Viewing all articles
Browse latest Browse all 20102

Forensic Hardware: Basic question on imaging

$
0
0
I prefer to use a shuttle box with external E-Sata ports and an E-Sata write blocker. I then use Encase to create a compressed E01 and work of that. I rarely do bit for bit copies as I find that I only have to create either a DD or an E01 somewhere down the line so take the hit from the start and create my image. I personally have found FTK Imager quite a slow piece of software for creating images. I found encase just in Acquisition mode a lot faster.

Viewing all articles
Browse latest Browse all 20102

Trending Articles