Network Acquisitions
Another method of acquiring hard drives is via a network cable between a machine containing the target media, booted to EnCase for DOS or Linux (LinEn), and a second machine running EnCase in the Windows environment. It often provides the best of both worlds, allowing some of the advantages of a DOS boot (Direct ATA access) combined with the enhanced functionality of EnCase in Windows. Again, this technique is now regarded as a legacy technique, having been replaced by LinEn. If you find it necessary to use this method, you will find it best to run EnCase 5 under Windows XP for the examination machine.
Reasons to Use Network Acquisitions
Network acquisition methods are useful in a variety of situations. They include the ...
Get EnCE EnCase Computer Forensics: The Official EnCase Certified Examiner Study Guide, 3rd Edition now with the O’Reilly learning platform.
O’Reilly members experience books, live events, courses curated by job role, and more from O’Reilly and nearly 200 top publishers.
