Convert from Encase...
 
Notifications
Clear all

Convert from Encase to DD/Raw

12 Posts
5 Users
0 Likes
4,250 Views
(@christopherkn)
Posts: 1
New Member
Topic starter
 

Hi

I need a program which can convert encase files to dd or raw format. I know FTK Image and Mount-Image Pro can do this, but I need something that wil work in linux.

A commando based version would be best, and I am running Fedora Core 7 on 64 bit.

Thank you

 
Posted : 17/07/2007 3:50 pm
azrael
(@azrael)
Posts: 656
Honorable Member
 

Have a look at

https://www.uitwisselplatform.nl/projects/libewf/

And this thread

http//www.forensicfocus.com/index.php?name=Forums&file=viewtopic&t=598

Azrael.

 
Posted : 17/07/2007 4:44 pm
(@apfelkraft-ch)
Posts: 15
Active Member
 

Ok, really old thing…but its possible the best place!

We have the problem, that ZiuZ always fail with E01 files. Now we find out, that dd works fine…. We also use Atola Hardware, this can create E01 and IMG at same time, but no dd….. ok, i will open E01 with FTK and export as dd…..but FTK can't open Atola E01 files and often also EnCase E01 files not.

Is there another tool, that can create dd from an E01 file?

 
Posted : 09/09/2017 7:17 pm
jaclaz
(@jaclaz)
Posts: 5133
Illustrious Member
 

Ok, really old thing…but its possible the best place!

We have the problem, that ZiuZ always fail with E01 files. Now we find out, that dd works fine…. We also use Atola Hardware, this can create E01 and IMG at same time, but no dd….. ok, i will open E01 with FTK and export as dd…..but FTK can't open Atola E01 files and often also EnCase E01 files not.

Is there another tool, that can create dd from an E01 file?

I am not sure to understand.

Which format is the "IMG" if not a "raw" dd one?

Under Linux
https://www.pinguin.lu/xmount

Under Windows (apart FTK imager)
Mount with Arsenal Image Mounter
https://arsenalrecon.com/weapons/image-mounter/
image to .dd using dd or any other imaging tool

jaclaz

 
Posted : 09/09/2017 7:46 pm
(@apfelkraft-ch)
Posts: 15
Active Member
 

Thank You, Arsenal was new for me….i think with the demoversion isn't possible? I need it for windows…. Will buy, but after testing. In the demoversion there is no export?

i am not sure witch IMG files atola creates….but it is not the same like dd….ziuz can't read the IMG files from Atola.

 
Posted : 09/09/2017 8:04 pm
jaclaz
(@jaclaz)
Posts: 5133
Illustrious Member
 

Thank You, Arsenal was new for me….i think with the demoversion isn't possible? I need it for windows…. Will buy, but after testing. In the demoversion there is no export?

i am not sure witch IMG files atola creates….but it is not the same like dd….ziuz can't read the IMG files from Atola.

No, the free version should work the same.
But there is no "export".
The idea is different.

The Arsenal Image Mounter is only a driver that can expose a (virtual) \\.\PhysicalDrive created out of the .E01 (using libewf), and nothing more.

You need your own imaging program (dd, FTK imager, whatever) to image the (virtual) \\.\Physicaldrive created by Arsenal Image Mounter.

Or just examine directly the (virtual) physicaldrive just created.

And AFAIK the ".IMG" an Atola may create is a .dd raw image, provided that you imaged the whole disk (physical).

Maybe - for *whatever* reason - you are experiencing issues in the imaging, and both the .E01 and the .IMG are *somehow* corrupted, or maybe they were some kind of "partial" images. ?

jaclaz

 
Posted : 10/09/2017 10:47 am
(@apfelkraft-ch)
Posts: 15
Active Member
 

Correct, the IMG files works on ziuz…looks like its the same like dd! The E01 is ok, it is also normal that FTK can't read the Atola E01 files….i have often E01 files, that FTK can't read…but autopsy and all other tools have no problem!
Thank you!

 
Posted : 10/09/2017 3:23 pm
jaclaz
(@jaclaz)
Posts: 5133
Illustrious Member
 

Correct, the IMG files works on ziuz…looks like its the same like dd!

Sure, it is a "raw" image.

The E01 is ok, it is also normal that FTK can't read the Atola E01 files….i have often E01 files, that FTK can't read…but autopsy and all other tools have no problem!

I don't find it so "normal", the whole idea of a documented format is that various tools can create and read it.

Thank you!

You are welcome. )

jaclaz

 
Posted : 10/09/2017 6:41 pm
mokosiy
(@mokosiy)
Posts: 54
Trusted Member
 

i am not sure witch IMG files atola creates….but it is not the same like dd….ziuz can't read the IMG files from Atola.

Being the person responsible for Atola product development, I can confirm that IMG file is a raw DD image. A bit-to-bit clone.

As for ziuz, I assume that Atola Insight Forensic holds IMG file handle open only while it is selected in the top port bar. This may be the reason why ziuz or other software is unable to open the IMG file.

Closing IMG file tab in the top panel should resolve the issue.

 
Posted : 11/09/2017 1:44 pm
jaclaz
(@jaclaz)
Posts: 5133
Illustrious Member
 

Being the person responsible for Atola product development, I can confirm that IMG file is a raw DD image. A bit-to-bit clone.

Which is good ) .

Now - if I may - if you could add this piece of info *anywhere* on Atola site, it would be easier for everyone to get to know that (although I jnew this was the case, I searched for this and couldn't find this piece of info anywhere on the Atola site to provide an official confirmation to the OP).

So the Atola products can save in ".IMG" (dd-like) and ".E01" (Encase EWF).

Any other formats?

jaclaz

 
Posted : 11/09/2017 7:00 pm
Page 1 / 2
Share: