EnCase Portable
While EnCase Portable has many features, I am not going to attempt to cover them all but will instead cover its acquisition features. I’ll cover the use of it to acquire from EnCase Portable as a boot device. With that knowledge, using it to make a live acquisition is a mere subset of doing so from boot.
I’ll assume you have EnCase Portable installed and otherwise ready to use. If you are going to use EnCase Portable to acquire a hard drive or sizeable device, one of the first considerations is to have media prepared to receive or store the image. With EnCase Portable, there is one added step, which is to prepare that device to work with EnCase Portable.
Get EnCE EnCase Computer Forensics: The Official EnCase Certified Examiner Study Guide, 3rd Edition now with the O’Reilly learning platform.
O’Reilly members experience books, live events, courses curated by job role, and more from O’Reilly and nearly 200 top publishers.
