EnCE EnCase Computer Forensics: The Official EnCase Certified Examiner Study Guide, 3rd Edition

Helpful Hints

As you encounter various devices, here are some suggested acquisition solutions:

• If you encounter a floppy disk, flip the write-protect notch to read-only and acquire in EnCase for Windows on a system where the floppy drive has been tested for its ability to write protect. Alternatively, you could do a DOS acquisition, but there’s usually no need.
• If you encounter a Zip or Jaz disk, use an IDE Zip or Jaz drive, and acquire in EnCase for DOS. You will need the GUEST.EXE file to mount the Iomega drivers. The easiest solution is to download the Zip-booter boot disk image from the Guidance Software website, update it with the latest EN.EXE, and you are set.
• If you encounter a CD/DVD, you can safely image it in Windows. You may encounter ...