O'Reilly logo

EnCE EnCase Computer Forensics: The Official EnCase Certified Examiner Study Guide, 3rd Edition by Steve Bunting

Stay ahead with the world's most comprehensive technology and business learning platform.

With Safari, you learn the way you learn best. Get unlimited access to videos, live online training, learning paths, books, tutorials, and more.

Start Free Trial

No credit card required

Restoration

Restoring the evidence file to another drive produces a cloned drive that can be used for many purposes. Often, this technique is used to boot the suspect’s machine with the cloned drive to conduct a myriad of special examinations, ranging from restore point analysis to using applications on the system. Also, using this method, you can see the system very much as the suspect did, which can provide valuable information that is difficult to obtain any other way.

EnCase provides the option to restore either the logical or physical drive. If your original evidence is a physical device, restoring the logical device only does not allow for verification as an exact copy. Usually, the physical drive is the best method for restoration, especially ...

With Safari, you learn the way you learn best. Get unlimited access to videos, live online training, learning paths, books, interactive tutorials, and more.

Start Free Trial

No credit card required