How to Combine RAID Array images in EnCase.

Guid on merging multiple RAID images (.001, .E01, etc.) into one forensic image with EnCase Forensic 8.

Rio Weber
Rio Weber
Apr 18, 2017 · 3 min read

RAID — Redundant Array of Independent Disks.
EnCase — Forensic software by Guidance Software.

./START

1. At the Home screen click “Add Evidence File

2. Select ALL RAID images and click Open.

3. Checkbox all images in the RAID.

4. With all RAID images checkmarked, click “Triage”.

*NOTE: if “Triage” does NOT work, try “Open” instead.

5. If Successful you will arrive at this page.

6. Right-click the first RAID image, goto “Device
Click “Scan Disk Configuration

7. On Success, a message box should confirm the images were “Added

8. Click “Back”

9. You should now have a complete single Image.

./END

HOW TO EXPORT NEW IMAGE

./START

1. Click into new created image.

2. Right-Click image.
GoTo “Acquire” then “Acquire”.

3. Change Path to where you want to Exported Image.
Select where you want to output file to be created.
You may also be required to input “Examiner Name”.

4. Click Format.
Make sure the “Format” is in “E01”.

5. If Successful you should see “Acquiring…” at the bottom of EnCase.

./END

dfclub

Bloomsburg University Digital Forensics Club.