Solution Guide

54 Ingest
e In the EnCase Acquisition screen, click the Add Device menu option.
f Ensure that the Sessions checkbox is checked.
g In the right-hand pane, select your case.
h Click Add Evidence Files ; then navigate to the E01 repository (using
the best practice configuration outlined in
Figure 3-5 , this repository
should be stored on drive
X:\ ).
i Click Next → Next → Finish . A stopwatch icon appears in the lower-right
portion of the EnCase
Acquisition screen, and EnCase will verify the
E01 file. Depending on the file size, the verification may take some time.
3 Within the EnCase software, add the target storage device using the Add
Device
wizard.
4 Acquire your device content.
a From within the EnCase software, click Cases → Entries → Home ; then
right-click the device you want to acquire.
b Select Acquire from the drop-down menu.
c In the After Acquisition dialogue box, select the appropriate New
Image File
type:
•
Do not add the options that exclude the newly-acquired image from
the case currently open.
•
Add to Case adds the newly-acquired image in the case file
associated with the device where the image was taken.
•
Replace a source device adds the newly-acquired image to the case
and removes the previewed device where the acquisition was made.
d Click Finish . When the imaging process is complete, the Acquisition
Results
dialog box will be displayed.
Working with Tableau Write-Blockers
CAUTION: Do not remove a hard drive from a forensic bridge while the power is
on.
CAUTION: Do not use USB cable extenders with any forensic bridge.