Video Transcription

00:00
All right. Welcome to advanced Ever Met Tree forensic acquisition. We'll talk about allocated nonlinear, partial and live images today.
00:09
All right. So elementary allocated on Lee, this is this is super useful when you have, you know, big discs and, you know, in your target computers, and you don't really need all the data that's on them. So, you know, if you have specific case and it might be about something,
00:26
you know, we're really only interested in say,
00:30
Ah, you know, the data that's actually on the the computer we're not interested in, you know, carving this. It's just not one of those type of cases. I don't need to recover a bunch of stuff for things like that,
00:44
you know? And it's also especially useful on things. Like if you got really large external USB backup drives and stuff like Kiss and and I'm really interested in is, you know, the backup files they're on there. I'm not gonna
00:55
carve this, you know, Giant eight terabyte disc or something for other backup files up because it's not just not required. Based on my case requirements allocated, only space comes in super handy. So I could save you a lot of time. A lot of storage space,
01:10
you know? And you avoid, you know, collecting large, mostly unused hard drives.
01:15
Easy to do. Generally pretty fast. Course you know, fast is a relative thing, right? Source and destination disco playing that fast day on. Gonna stay here, and I'm gonna show you when we're doing it. But you want to remember to make sure when you're doing this to click the
01:30
check or click or check the capture auto closed box when you're making an allocated
01:36
only forensic image? Because if I don't do that, I'm gonna sit there and wonder why my my collection never finishes. Well, it's waiting for me to do something. So
01:47
as as we head into this, we'll definitely take a look at that.

Up Next

Advanced Evimetry Forensic Acquisition: Allocated, Non-Linear Partial, and Live Images

This free course covers advanced forms of disk imaging that can be invaluable in cases where acquiring large amounts of unused disk space is not ideal, and where only certain file types are needed when you need to collect data from a live system.

Instructed By

Instructor Profile Image
Brian Dykstra
CEO and President of Atlantic Data Forensics
Instructor