Physical Disk Emulator (PDE)
The Physical Disk Emulator (PDE) module is similar to the VFS in many ways, but there are some clear and distinct differences:
- PDE can mount only a physical disk or volume. VFS can also mount an image file.
- When PDE mounts a disk or volume, Windows treats it as a disk or volume. Windows treats a VFS-mounted item as a network share.
- PDE mounts file systems supported by Windows. VFS mounts any file system supported by EnCase.
- With VFS you can see unallocated clusters, deleted files, and recovered partitions.
- With PDE, you can use VMware to mount a disk as a virtual machine.
When PDE mounts a disk or volume, it will appear in the Windows Logical Disk Manager, which is a service that starts when there is a need to ...
Get EnCE EnCase Computer Forensics: The Official EnCase Certified Examiner Study Guide, 3rd Edition now with the O’Reilly learning platform.
O’Reilly members experience books, live events, courses curated by job role, and more from O’Reilly and nearly 200 top publishers.
