How To Load DD Images into EnCase TM

If you are dealing with a forensic hard drive copy that is in DD format, it is a simple but not intuitive process to load that drive image into EnCase.

Here’s how you do it.


Step 1:  From the File Menu, Select Add Raw Image

Step 2: Select the type of image you need to load.  Is this example I am going to load a Disk Image

Step 3: Right click in the Component Files area and Select New

Step 4: Browse to the folder containing the images and sort them in ascending order.

Step 5:  Select all of the parts of the DD image.

Step 6: Click OK to load the image parts into the Component Files dialog.

Step 7: Click OK again to load the parts into Encase

You should now see the drive image correctly mounted in EnCase.


Post comments, for more EnCase Stuffs........