Greetings, in a recent acquisition we created EnCase images of a couple Palm Pilots. Could someone please confirm to me in email what exactly an 'empty' palm looks like? One of those Palms didn't turn on and had to be reset. The EnCase data is pretty all zero's with the exception of a repeating block of U's. That was somewhat expected after the reset. The other Palm is pretty much all zero's as well, but with a repeating, 500 byte block of data (repeating every 65535 bytes). The Palm's weren't really in the scope, but we acquired them anyway since we had the opportunity :) So if the acquisition was flawed, it's no harm to the case. I'm just trying to figure out if what I'm seeing is normal, or if something messed up with EnCase (v 3.19 btw) during the acquisition. Thanks, Frank
This archive was generated by hypermail 2b30 : Thu May 30 2002 - 03:11:33 PDT