Encase Network Drive Capture?

dcldd could be a good choice, included in Helix, the easiest way to get it work.

I want to image the C: drive of another workstation onto my forensics workstation via the network.  It seems that there is not a really good way to do this in Encase though.  I know of outside tools that can do this but wonder if their is any good way to do this in encase.

Assuming you are using Encase Forensic Edition 6.12 and not Encase Enterprise...

The vendor-approved method of doing an acquisition over the network is using a network boot CD, booting the system via that CD, and configuring the IP of the machine within the same range as your forensics workstation.  Then firing up LinEn and doing the copy via a network cross-over cable.  It is, most definitely, not an elegant setup.  The reason for this is that Guidance Software sells a product called Encase Enterprise that is designed to be used for network acquisitions.  As Encase Enterprise grew as a product, support for a "streamlined network acquisition" in Encase Forensic Edition kind of fell off.

Forensic Edition is primarily designed to have hard drives directly connected to your forensic workstation, either via directly connecting them to the motherboard or by using a USB to IDE/SATA adapter.

Currently, the method that I use when I need to do a network acquisition is to boot the target machine with a Helix CD.  Helix is a/was an open-source forensically sound Linux distribution of various forensic tools, one of which is LinEn, which is the Linux Encase network copy utility.  ( I say WAS because they recently went to also selling a pay-for version, but I think you can still download the free versions)

Since you are running 6.12, I figure you probably have access to the Encase User Manual which came with the product.  Chapter 4 is devoted entirely to using and configuring Linen.  

I wish I could tell you that there was an easier way, like an Encase provided boot disc, or some utility that came with Encase FE that you could run on the target machine, but this is the approved method.

I have used Helix before and it works quite well.  For the project then, I think I am going to do both a demonstration of directly connected media as well as the LinEn methods.  As the project is strictly limited to using the program itself (as its a Encase Demonstration Purely) that is what I will be limited to.  However, for my own knowledge what is an alternative way to make a forensic disk image with any non Helix open source programs?