Enterprise Vault™ EnCase® Ingest Connector Implementation Guide
Preparing map files from EnCase evidence files
EnCase evidence files are full bit stream images of entire devices. To use the Ingest Connector to extract selected files from the disk image, you must first create a map file by running the Ingest Connector EnScript file from within the EnCase product. Following that, you can then use the Ingest Connector to select specific files and move them into a vault.
Note:
The Ingest Connector is currently only supported in EnCase product version 4.20 or newer.
To prepare a map file for an existing evidence file
- Within the EnCase product, select all of the files that you would like to migrate into the vault.
- Run the Ingest Connector script located in the Veritas EnScript folder.
Note:
See the EnCase documentation for assistance in running EnScript files.
- Make the desired selections in the dialog:
Available evidence files - Use this list box to select the evidence that contains the files you want to migrate.
Note:
Only one map file can be created at a time, and you must create a separate map file for each evidence file (each item in the list).
Path to your evidence file - Use this text entry box to designate the location of the evidence file.
Output Directory - Use this text entry box to designate where the map file will be stored. Click the Browse button to navigate to the location.
- Click OK.
Note:
For EnCase evidence files that contain Dynamic Disks or software RAID configurations, EnCase products have the ability to mount Windows Dynamic Disks as well as software RAID configurations. If you use this feature to mount one of the types of evidence, you will need to reacquire an EnCase evidence file for the logical interpretation of the dynamic disk or software RAID. Once you have acquired the logical drive that EnCase products provide, you can then add it to your case and prepare it with the Ingest Connector.