Providing leading forensic services
Get split/compressed Norton Ghost (GHO) images loaded into EnCase
During a recent case, we received a set of 4 compressed/split Norton Ghost image files. The image files were created with Norton Ghost v11. As it turns out, none of the forensic tools we had available (EnCase, FTK) were able to read these compressed Norton Ghost (GHO) files. I reached out to list serves (all [...]
Missing parent email after FTK export
Scenario: You perform a keyword search. FTK returns hits emails with attachments for the keyword you searched for. Since you are a good forensic examiner, you validate the completeness of the results. Unfortunately, you notice that several attachments reference emails which are not present.Reason: The keywords hit only on the attachment content, yet not on [...]