How to Combine RAID Array images in EnCase.
Guid on merging multiple RAID images (.001, .E01, etc.) into one forensic image with EnCase Forensic 8.
RAID — Redundant Array of Independent Disks.
EnCase — Forensic software by Guidance Software.
./START
1. At the Home screen click “Add Evidence File”
2. Select ALL RAID images and click Open.
3. Checkbox all images in the RAID.
4. With all RAID images checkmarked, click “Triage”.
*NOTE: if “Triage” does NOT work, try “Open” instead.
5. If Successful you will arrive at this page.
6. Right-click the first RAID image, goto “Device”
Click “Scan Disk Configuration”
7. On Success, a message box should confirm the images were “Added”
8. Click “Back”
9. You should now have a complete single Image.
./END
HOW TO EXPORT NEW IMAGE
./START
1. Click into new created image.
2. Right-Click image.
GoTo “Acquire” then “Acquire”.
3. Change Path to where you want to Exported Image.
Select where you want to output file to be created.
You may also be required to input “Examiner Name”.
4. Click Format.
Make sure the “Format” is in “E01”.
5. If Successful you should see “Acquiring…” at the bottom of EnCase.
