Recovers traces of the use of about 50 different wiping tools from Windows: file systems, registry, and timeline.
Automatically determine and rename the true volume drive letters for Encase evidence items.
This tool solves a small (but painful) problem: it detects and assigns the correct drives letters to volumes within EnCase. It uses the MBR/GPT, MountedDevices, Recycle Bin original path, shortcut target paths and serial numbers, common sub-folders, common volume names and a few other tricks.
The password is “AccurRename”. Please review the ReadMe.txt (in the zip) for instructions on how to use the tool.