All right. Welcome to advanced Ever Met Tree forensic acquisition. We'll talk about allocated nonlinear, partial and live images today.
All right. So elementary allocated on Lee, this is this is super useful when you have, you know, big discs and, you know, in your target computers, and you don't really need all the data that's on them. So, you know, if you have specific case and it might be about something,
you know, we're really only interested in say,
Ah, you know, the data that's actually on the the computer we're not interested in, you know, carving this. It's just not one of those type of cases. I don't need to recover a bunch of stuff for things like that,
you know? And it's also especially useful on things. Like if you got really large external USB backup drives and stuff like Kiss and and I'm really interested in is, you know, the backup files they're on there. I'm not gonna
carve this, you know, Giant eight terabyte disc or something for other backup files up because it's not just not required. Based on my case requirements allocated, only space comes in super handy. So I could save you a lot of time. A lot of storage space,
you know? And you avoid, you know, collecting large, mostly unused hard drives.
Easy to do. Generally pretty fast. Course you know, fast is a relative thing, right? Source and destination disco playing that fast day on. Gonna stay here, and I'm gonna show you when we're doing it. But you want to remember to make sure when you're doing this to click the
check or click or check the capture auto closed box when you're making an allocated
only forensic image? Because if I don't do that, I'm gonna sit there and wonder why my my collection never finishes. Well, it's waiting for me to do something. So
as as we head into this, we'll definitely take a look at that.