Restoring an image

[David (PassMark)]

When you restored the image to the new Touro drive, I assume you used the ""Restore image" feature in "Drive imaging" in OSF?
What did you select as the Target Disk? Did you select the entire physical drive or a partition?
Same question about the image creation process? Did you select the entire drive or just a partition?

[ddr]

Yes, an Encase .EO1 format image. The image was made of an external USB drive the client was using to back up his data. The client's system was Windows XP, so that is the system that originally wrote to the disk.

The original drive was:
Maxtor DiamondMax
160 Gig
Manufacture Date:03May2005
SN: B427BW0H
IDE (PATA) Interface set to CS

The drive as inside an external enclosure with the word "Ultra" on the side and seems to be a generic external inclosure with a USB to IDE card inside.

I'm writing to an external USB drive made by TOURO. It is a 500 gig drive that I have wiped and formatted under Windows 7.

But I have made it one large primary partition. Maybe I should make a 160 partition on the drive and try restoring to just that partition and see what happens. Would you sugest I make that a primary or an extend partition?

[David (PassMark)]

Is the EnCase image .E01 format?
What is the make & model of the destination USB drive? Some of them have fancy partitioning and pretend they are CD drives.

What file system is in the EnCase image? OSF can for example read HFS+ file systems from a Mac, but Windows itself will give the message about not having a recognized file system.

[ddr]

I am using the OSForensic 3.0 beta. I have 2 USB external drives connected. One drive has the image on it, created in Encase format, and the the other drive is blank. I want to restore the Encase image to the blank drive. I have done this a few times, but I seem to be doing something wrong.

After the image is restored and verified, Windows keeps telling me that the drive does not have a recognized file system and the drive must be formatted. However, if I look at the drive by adding it to the case in OSForensics, I am able to see the data and the file structure on the drive.

How do I restore the image in such a way as to make it read as the original drive and have the file structure show up in Windows?

I'm using Windows 7. I have tried this on two different computers with the same result.