1. Add the raw image file by clicking to the File pull-down menu and selecting Raw Image.... (You cannot add a raw image by using the Add Device button.)
2. At the top of the "Raw Image" dialog box is an "Alias" field. The value that you type in here will be the name of the evidence file once it is added to the case in the Cases tab of EnCase.
Right-click in the Component Files section to add the raw image file.
Right-click for menu, left-click for command
|
3. Add the raw image "chunks" in the order that you created them. Right-click for the New and Delete commands to add or delete image file chunks. You also must specify what kind of image file you are adding.
- None: will add the entire image as Unallocated Clusters
- Disk: for physical disk
- Volume: locally mounted drive-letters. This would include floppies, removable media, logical volumes, etc.
- CD: for CD-ROMs
You can delete files as well |
4. After adding the raw image chunks in the order they were created, giving a name, and specifying the image types for the images, click OK. EnCase will add the image files to the case.
Note: SafeBack images are not "flat" files. You cannot add SafeBack images directly into EnCase.
|
