O'Reilly logo

EnCE EnCase Computer Forensics: The Official EnCase Certified Examiner Study Guide, 3rd Edition by Steve Bunting

Stay ahead with the world's most comprehensive technology and business learning platform.

With Safari, you learn the way you learn best. Get unlimited access to videos, live online training, learning paths, books, tutorials, and more.

Start Free Trial

No credit card required

Physical Disk Emulator (PDE)

The Physical Disk Emulator (PDE) module is similar to the VFS in many ways, but there are some clear and distinct differences:

  • PDE can mount only a physical disk or volume. VFS can also mount an image file.
  • When PDE mounts a disk or volume, Windows treats it as a disk or volume. Windows treats a VFS-mounted item as a network share.
  • PDE mounts file systems supported by Windows. VFS mounts any file system supported by EnCase.
  • With VFS you can see unallocated clusters, deleted files, and recovered partitions.
  • With PDE, you can use VMware to mount a disk as a virtual machine.

When PDE mounts a disk or volume, it will appear in the Windows Logical Disk Manager, which is a service that starts when there is a need to ...

With Safari, you learn the way you learn best. Get unlimited access to videos, live online training, learning paths, books, interactive tutorials, and more.

Start Free Trial

No credit card required