Knowledgebase:
Adding File System Evidence (Disk or Folder)
Posted by Jack H. Ward, Last modified by Jack H. Ward on 29 January 2018 03:19 AM

To add new file system evidence to the case:

1.On the Evidence tab, in the Evidence group, click Add Evidence; or right-click the case node and select Add New Evidence.

2. If no case has been created, the New Case wizard will open. This allows the user to create a new case.
3. The Add New Evidence window opens.

4. Select the Evidence category:

  • Logical Drive or Folder: Adds a logical disk on the computer on which Electronic Evidence Examiner is installed as evidence OR Adds network/local folder or folder on the CD/DVD as evidence.
  • Physical Drive: Adds a physical disk.


5. Click OK.
6. In the Browse For Folder window, navigate to the location of the desired folder. Click OK.
7. Enter the Evidence name (opened folder name by default) and click OK.
8. If the folder is stored on a disk with an NTFS file system, define the NTFS settings and click OK.
9. The folder is added to the case.
10. The structure of the added folder is displayed in the Case Content pane (to the left). The contents of the selected folder/node are displayed in the Data View pane (to the right).
11. You can view the contents of files and folders and unallocated space.





Attachments 
 
 Adding File System Evidence (Disk or Folder).png (29.42 KB)
(0 vote(s))
Helpful
Not helpful

Comments (0)