With EnCase® Version 3 and EnCase® Version 4, it is possible to copy/uneras

EnCase® Version 3 and 4 support the previewing and acquiring of Palm PDAs. Version 3 supports serial Palm devices, and Version 4 supports both serial and USB Palm devices.

Palms supported

• IIIx, IIIxe (v3, v4)
• V series (v3, v4)
• VII series (v3, v4)
• M series (v4)

Directions

1. Put the Palm PDA (Pilot or Handspring) in its cradle
2. Attach the cradle cable to an available serial port on your computer
3. Boot up the computer into Windows
4. Launch EnCase® for Windows.
5. Turn Palm PDA on. Put in Console mode.

1. Lower-case cursive 'l' on left-side of "graffiti" area
2. Double-dot on left-side of "graffiti" area
3. Number '2' on right-side of "graffiti" area

PuConsole mode...

Note: You can tell when a Palm is in console mode by a slightly longer sound than the normal "beep". To exit console mode, you must soft-reset the Palm.
Note: If you do not hear a "beep" sound when putting the Palm into console mode, check the system volume settings (found under Preferences/General). The System Sound should not be set to "Off".

6. Back at your computer, click the Add Device button in EnCase®.
7. Source: "Local" and "Palm Pilot".

8. You will see all serial devices attached to your computer. The figure below shows the Palm on COM2. Blue-check the Palm and click NEXT.

9. Confirm the Palm to preview. Click FINISH.

Edit device properties by double-clicking device at this screen

At this point, you can double-click the device and edit device properties, such as the device name, device notes, and more.

10. You will see the Palm under the Cases tab.

A previewed Palm

11. Right-click on the Palm icon under the Cases tab and select Acquire…. Choose whether to have a password or not, to use compression or not, etc.

Acquisition options

12. You will see the Palm acquiring. It can be very fast as it is acquiring directly from RAM (see "Final Note" below).

Getting Out of Console Mode

To get a Palm out of "console mode," you must do a soft reset on the Palm. Turning the Palm off and back on again does not take it out of console mode, and leaving it in console mode will cause the battery to drain faster than usual.

1. Locate the small hole on the back of the Palm labeled "RESET."
2. Press the tip of a pen into the hole.

One Final Note on Palms

Initially previewing a serial Palm PDA may be slow because standard serial ports transfer data at a max of 115kbps. The preview and acquisition of a Palm Vx, for example, takes between 30 and 40 minutes. USB Palms will be faster; a 12MB m500, for example, took four minutes to preview and 16 minutes to acquire. However, after the first keyword search on a previewed device, all other processes accessing the evidence file will be fast, as the entire evidence file has been cached in memory.