Ingesting encase files

  • KM02753466
  • 16-Mar-2017
  • 26-Mar-2019

Summary

What type of encase files HPeD supports

Question

Supporting the ingestion of Encase files

Answer

MFeD supports simple encase files only. It does not support multi-volume encase files . The same is true for disk images inside the encase file.
 
Any Encase file that has an image disk encapsulated should be mounted outside the application (you can use FTK or iMDisk) and then the content can be copied to the input folder for further processing