Description

Encase has the ability to image an entire workstations hard disk(s) to an L01 or an E01 file (If the format is E01, please see HOWTO110361).

There are a few considerations that need to be made when processing these files:

1. Be sure to enable the NIST list since this file will contain many Windows System files that Clearwell is unable to read, and are unnecessary for cases
2. When processing the Encase file through a Case Folder Source, there are options to further cull data by providing specific extensions to ignore for processing
3. After processing is complete there may be a large amount of errored data that shows in the "Sources & Pre-processing" glyph.
   1. Go to Processing > Reports
   2. Run the "Discovery Errors" report
   3. Check the report for "Unallocated Clusters"
4. "Unallocated Clusters" is Encases term for unused space on a hard disk. (When deleting a file on a hard drive, the address to that file is removed from the Master Boot Record, but the file data still exists until it is overwritten by other data.) Clearwell is unable to process this part of the file, so this is normal to see in the report.