Home General

EnCase 8.06 Copy Files option is not available under Entries menu

edited September 14, 2019 in General

I'm trying to Copy files from EnCase. However i can't find the Copy Files option in Entries dropdown menu.

I have connected the Encase processor license dongle which is active. Is there any reason for why i can't copy files?

Thanks,
Kelum

Quote from EnCase User Guide the Instruction related to Copy files;

Copying Files
To copy files:
1.In the Evidence or Artifacts tab, click the Entries dropdown menu and select Copy Files.
2.In the Results, Indexed Items, Keyword Hits, or Tagged Items tab, click the Results dropdown menu and select Copy Files.
3.The Copy Files dialog displays.
◦Select Highlighted File to copy the highlighted file.
◦Select All selected files to copy the currently selected files in the table.
◦Separate Files outputs each file to its own file.
◦Merge into one file merges the output of all selected files into one file.
◦Replace first character of FAT deleted files with determines which character is used to replace the first character in the filename of deleted files in the FAT file system. Deleted files on a FAT volume have a hex \xE5 character at the beginning. The underscore ( _ ) character is used by default to replace this character.
4.Click Next. The Options dialog displays.
◦Copy Files contains settings that determine the content of the evidence file to be copied.Logical File Only performs the copy function on the logical file only, not including the file slack.
Entire Physical File performs the copy function on the entire physical file, including the logical file and file slack.
RAM and Disk Slack performs the copy function on both the RAM and disk slack.
RAM Slack Only performs the copy function on the RAM slack only.

◦The Character Mask settings determine what characters are written into the file or files created by the copy function.Select None if you do not want any characters masked or omitted from the filenames of the resulting files.
Select Do not Write Non-ASCII Characters to mask or omit non-ASCII characters from the filenames of the resulting files. All characters except non-ASCII characters are retained.
Select Replace NON-ASCII Characters with DOT to replace non-ASCII characters with periods in the filenames of the resulting files.

◦Checking Show Errors causes the application to notify you when errors occur. This prevents the unattended execution of the Copy Files operation.
5.Click Next. The Destination dialog displays.
◦Copy displays the number of files to be copied, and the total number of bytes of the file or files created.
◦Path shows the path and filename of the file or files to be created. The default is My Documents\EnCase[case name]\Export.
◦Split files above contains the maximum length, not exceeding 2000MB, of any file created by the Copy Files function. When the total number of bytes in an output file exceeds this value, the additional output continues in a new file.
◦Use Initialized Size determines whether to use the initialized size of an entry, rather than the default logical size or the physical size. This setting is only enabled for NTFS and exFAT file systems. When an NTFS or exFAT file is written, the initialized size can be smaller than the logical size, in which case the space after the initialized size is zeroed out.
6.Click Finish. The Copy Files operation executes. The resulting files are saved in the directory specified in the Destination dialog.

Comments

  • Karen WeirKaren Weir Moderator EM admin

    Hi @Kelum Perera ,

    Please upgrade your account to include My Support Access so that we can move your question into the product-specific area on the forums and get the best experts to review/comment.

    Karen


    Karen Weir
    Forum Moderator
    OpenText

  • BillyT22BillyT22 Director of Professional Development & Training UK EMEA EM

    From the screenshot previously posted, it would seem that there are a couple of issues which would have prevented that functionality.

    1. From the title bar of the instance of EnCase in the screenshot, EnCase appears to be licenced as a processor. As such, this will limit the functionality of encase to use the functionality of the Evidence Processor rather than the full functionality.
    2. The file selected for copying is actually a file marked as 'deleted overwritten'. This is indicated by the looping red arrow on the bottom righ corner of the icon of the selected file. Also when you look at the status bar, it relates to the overwritting file. Therefore if you were using EnCase in examiner mode and were able to copy the slected file, you would be retrieving the data of the overwriting file.

    Bill A Thompson
    Opentext Learning Services (EnCase Training)

Sign In or Register to comment.