tag:blogger.com,1999:blog-4080617372940068027.post241015396754453251..comments2024-03-13T01:32:25.097-04:00Comments on Journey Into Incident Response: Review of Windows Forensic Analysis 3rd EditionCorey Harrellhttp://www.blogger.com/profile/15008629321023489214noreply@blogger.comBlogger4125tag:blogger.com,1999:blog-4080617372940068027.post-77731958934169849552012-02-28T13:16:09.935-05:002012-02-28T13:16:09.935-05:00@girlunallocated
Thanks for the comment and I'...@girlunallocated<br /><br />Thanks for the comment and I'm glad what I post is useful. I'm a fan of your blog as well but similarly I have only threw a few comments your way. :(Corey Harrellhttps://www.blogger.com/profile/15008629321023489214noreply@blogger.comtag:blogger.com,1999:blog-4080617372940068027.post-14152831970916995112012-02-28T13:11:00.266-05:002012-02-28T13:11:00.266-05:00@Rob
FTK Imager won't work for mounting an im...@Rob<br /><br />FTK Imager won't work for mounting an image so you can see VSCs. Harlan discusses a method to use in the book. I haven't tried that method yet ... I've been successful with mounting the original drive as well as using Encase PDE module.<br /><br />Windows 7 was one piece that makes WFA 3/e so worth it.Corey Harrellhttps://www.blogger.com/profile/15008629321023489214noreply@blogger.comtag:blogger.com,1999:blog-4080617372940068027.post-72359794533993287922012-02-28T11:36:30.305-05:002012-02-28T11:36:30.305-05:00Corey,
Thank you for the great redux of the book....Corey,<br /><br />Thank you for the great redux of the book. I'm in the process of reading it now, and having your thoughts has been very useful as I move forward. <br /><br />BTW - I am one of those readers who frequents your blog, but rarely writes a comment. I thought I'd rectify the inequality somewhat by letting you know how much I have learned from you. Thank you so much for providing such useful information so consistently.Girl, Unallocatedhttps://www.blogger.com/profile/14531145168136293345noreply@blogger.comtag:blogger.com,1999:blog-4080617372940068027.post-20252146386317725042012-02-28T10:18:42.701-05:002012-02-28T10:18:42.701-05:00Corey,
I have always had issues viewing VSC's...Corey,<br /> I have always had issues viewing VSC's when mounting the Forensic image files with Imager or some other method. The only thing that has worked for me is using the original drive behind a write blocker. I wonder what I am doing wrong to not see those? Hmm..Good to know it can be done..<br /><br />Thanks for the Review.. I was on the fence with this one, but seeing that we are in a Win 7 world its time to update the library.<br /><br /> RobRobhttps://www.blogger.com/profile/05553397674741084481noreply@blogger.com