When importing from a folder structure, NetAnalysis requires that the folder structure contains files that have not been renamed in the export process, they must have their original file names. Exporting in a structure also makes it much easier for the examiner to identify the exact location of an artefact within the original file system.
EnCase v6.19
EnCase has the ability to export files from an image in their original folder structure. In the following example, EnCase is used to export the entire user profile of a suspect.
Step 1 - Tick/Check the profile of interest
Step 2 - Click on the Edit Menu
Step 3 - Select Copy Folders...
Step 4 - Copy only Selected Files Inside Each Folder
You must ensure that Copy only selected files inside each folder is ticked/checked if you have manually selected/filtered a subset of files inside the profile (e.g. you have filtered and selected only INDEX.DAT files).
Step 5 - Select an Export Folder
Step 6 - Click OK
NetAnalysis - Open All History From Folder
Now that the files have been exported, select File » Open All History from Folder in NetAnalysis and select the export folder containing the exported EnCase files.
