Page tree
Skip to end of metadata
Go to start of metadata

When importing from a folder structure, NetAnalysis requires that the folder structure contains files that have not been renamed in the export process, they must have their original file names.  Exporting in a structure also makes it much easier for the examiner to identify the exact location of an artefact within the original file system. 

EnCase v6.19

EnCase has the ability to export files from an image in their original folder structure.  In the following example, EnCase is used to export the entire user profile of a suspect.

Step 1 - Tick/Check the profile of interest

 

Step 2 - Click on the Edit Menu

 

Step 3 - Select Copy Folders...

 

 

Step 4 - Copy only Selected Files Inside Each Folder

(warning) You must ensure that Copy only selected files inside each folder is ticked/checked if you have manually selected/filtered a subset of files inside the profile (e.g. you have filtered and selected only INDEX.DAT files).

Step 5 - Select an Export Folder

 

Step 6 - Click OK

 

NetAnalysis - Open All History From Folder

Now that the files have been exported, select File » Open All History from Folder in NetAnalysis and select the export folder containing the exported EnCase files.