If you are dealing with a forensic hard drive copy that is in DD format, it is a simple but not intuitive process to load that drive image into EnCase.
Here’s how you do it.
Step 1: From the File Menu, Select Add Raw Image
Step 3: Right click in the Component Files area and Select New
Step 4: Browse to the folder containing the images and sort them in ascending order.
Step 5: Select all of the parts of the DD image.
Step 6: Click OK to load the image parts into the Component Files dialog.
Step 7: Click OK again to load the parts into Encase
You should now see the drive image correctly mounted in EnCase.
Post comments, for more EnCase Stuffs........