5. Adding Evidence Files

• Evidence Files can be added to the case at any time via:

  • (a) Add device button on the button bar, or via

    (b) File -> Add device Menu.

    • IMPORTANT: use write blocker, hardware (preferred) or software-based.

    • Also, you can then

      • right-click on the added device in Tree Pane, and

      • create the evidence file via Acquire option. You will have a chance to replace the device by the acquired image.

    • See EnCase Lesson 3, page 31 for details.

    (c) Right-clicking on Evidence Files in Tree Pane and then New.

• Navigate to the evidence folder and follow the rest of the dialog box prompts (see EnCase Lesson 12, Adding Evidence to a Case.)

• Use blue selection check marks to select the evidence you wish to add.

• Only need to add .E01 (.E02, .E03, ... files are added automatically.)

• NOTE: Same support provided for SafeBack image file format, .001, .002, ...