Finding Fraudulent Documents Preview  Wednesday, May 16, 2012
Posted by Corey Harrell 2 comments       Labels: ,  More About
Volume Shadow Copies  Tuesday, May 8, 2012 Posted by Corey
Harrell 0 comments  CyberSpeak Podcast About Volume Shadow
Copies   Determining Volumes with VSCs and What Files Are
Excluded from VSCs    Using the Sift to Access VSCs    Sift
Workstation Steps  1. Provide access to image in raw format 2.
Enable the SIFT iSCSI service 3. Edit the iSCSI configuration
file 4. Restart the iscsitarget service  Windows 7 Host Steps
5. Search for iSCSI to locate the iSCSI Initiator program 6.
Launch the iSCSI Initiator 7. Enter the Sift IP Address and
connect to image 8. Examine VSCs  Sift Workstation Steps  1.
Provide access to image in raw format   Split raw image:  sudo
affuse path-to-image mount_point  E01 Format use:  sudo path-to-
image mount_point  2. Enable the SIFT iSCSI service   sudo gedit
/etc/default/iscsitarget  (Change “false” to “true”)  3. Edit
the iSCSI configuration file   sudo ged