There are a number of (relatively low cost) software packages available which will let you mount and assign a drive letter to an EnCase, FTK, AFF, etc. forensic drive image.   By being able to mount the forensic drive image as a drive letter you can process the data contained in the drive image along with all of the other data you have.
By understanding in the early case assessment phase of your matter what the forensic drive images contain, the emails, loose documents, etc. you can arrive at a more meaningful budget and a more defensible set of reports for use in the meet and confer or in motions, etc.
Several software products to consider are:
Mount Image Pro  www.mountimage.com
Sluethkit www.sleuthkit.org
GetData www.getdata.com
0 Comments until now
Add your Comment!