Can't see digital camera SD card

[scott93933]

I'm working with two EnCase images; one is of a Windows system and the other is of a digital camera SD card. Since I don't work with EnCase, I've used Mount Image Pro v5 to mount the EnCase images and then I'm using OSForensics to access the mounted volumes. OSForensics works with the Windows volume very well and can recover both visible and deleted files.

OSForensics doesn't even see the digital camera SD card volume however (even though it appears in My Computer and can be perused from the desktop). Can anyone explain to me why this is occurring or how to work around it? I really need to recover the deleted files from that SD card volume.

Thanks for your help!
Scott

[David (PassMark)]

You can do direct access on EnCase images. There is no need to use Mount Image Pro.
Even if you did want to mount them with a drive letter, then there is a function for this built into OSF in any case.

What file system is on the SD card image (e.g. FAT, NTFS, something else)?
What version of OSF are you using?
What function did you attempt to use in OSF that lead you to believe that OSF doesn't 'see' the drive?

[scott93933]

Hi David,
I'm not in front of the workstation at the moment, so I don't know what filesystem is on the SD card image, but I'm going to guess that it's probably FAT. Are there any filesystems in common use on digital camera cards that OSForensics can't access?

I'm using the latest version of OSF (free) and am considering upgrading to the full (paid) version.

With the SD card image mounted, if I select "Deleted File Search," for example, the pull-down menu that contains all of the mounted volumes (including drive letter) in OSF does not list the drive letter of the mounted SD card image among the other volumes in the menu.

Do I access EnCase images using OSFMount to mount them first and then use OSForensics, or is there a way to mount them directly from OSForensics?

Also, I see there's a "Discount code" field on the shopping cart page. Is there a discount code I can use to defray the cost a bit?

Thanks for your help!
Scott

[scott93933]

Hi David,
Turns out it's FAT16 and you're right, OSF opens it directly, without the need for any other standalone utilities, including OSFMount (which appears to be built-into OSF).

The only remaining question is about the "Discount Code."
Thanks,
Scott

[David (PassMark)]

We have volume discounts, upgrade discounts, cross grade discounts, regular reseller discounts & educational discounts. I'm not sure if you qualify for any of these?