±Forensic Focus Partners

Become an advertising partner

±Your Account


Username
Password

Forgotten password/username?

Site Members:

New Today: 1 Overall: 32774
New Yesterday: 3 Visitors: 221

±Follow Forensic Focus

Forensic Focus Facebook PageForensic Focus on TwitterForensic Focus LinkedIn GroupForensic Focus YouTube Channel

RSS feeds: News Forums Articles

±Latest Articles

RSS Feed Widget

±Latest Webinars

Convert from Encase to DD/Raw

Forensic software discussion (commercial and open source/freeware). Strictly no advertising.
Reply to topicReply to topic Printer Friendly Page
Forum FAQSearchView unanswered posts
Go to page Previous  1, 2 
  

Re: Convert from Encase to DD/Raw

Post Posted: Sun Sep 10, 2017 12:41 pm

- apfelkraft.ch
Correct, the IMG files works on ziuz...looks like its the same like dd!

Sure, it is a "raw" image.


- apfelkraft.ch
The E01 is ok, it is also normal that FTK can't read the Atola E01 files....i have often E01 files, that FTK can't read...but autopsy and all other tools have no problem!

I don't find it so "normal", the whole idea of a documented format is that various tools can create and read it.

- apfelkraft.ch

Thank you!

You are welcome. Smile

jaclaz
_________________
- In theory there is no difference between theory and practice, but in practice there is. - 

jaclaz
Senior Member
 
 
  

Re: Convert from Encase to DD/Raw

Post Posted: Mon Sep 11, 2017 7:44 am

- apfelkraft.ch

i am not sure witch IMG files atola creates....but it is not the same like dd....ziuz can't read the IMG files from Atola.


Being the person responsible for Atola product development, I can confirm that IMG file is a raw DD image. A bit-to-bit clone.

As for ziuz, I assume that Atola Insight Forensic holds IMG file handle open only while it is selected in the top port bar. This may be the reason why ziuz or other software is unable to open the IMG file.

Closing IMG file tab in the top panel should resolve the issue.
_________________
Vitaliy Mokosiy
CTO
Atola Technology 

raydenvm
Member
 
 
  

Re: Convert from Encase to DD/Raw

Post Posted: Mon Sep 11, 2017 1:00 pm

- raydenvm

Being the person responsible for Atola product development, I can confirm that IMG file is a raw DD image. A bit-to-bit clone.

Which is good Smile .

Now - if I may - if you could add this piece of info *anywhere* on Atola site, it would be easier for everyone to get to know that (although I jnew this was the case, I searched for this and couldn't find this piece of info anywhere on the Atola site to provide an official confirmation to the OP).

So the Atola products can save in ".IMG" (dd-like) and ".E01" (Encase EWF).

Any other formats?

jaclaz
_________________
- In theory there is no difference between theory and practice, but in practice there is. - 

jaclaz
Senior Member
 
 
  

Re: Convert from Encase to DD/Raw

Post Posted: Tue Sep 12, 2017 4:06 am

- jaclaz

Now - if I may - if you could add this piece of info *anywhere* on Atola site, it would be easier for everyone to get to know that (although I jnew this was the case, I searched for this and couldn't find this piece of info anywhere on the Atola site to provide an official confirmation to the OP).

So the Atola products can save in ".IMG" (dd-like) and ".E01" (Encase EWF).

Any other formats?

jaclaz


Thank you for recommendation. We should improve that, yes.

As for supported target images, there are just a raw image and E01 at the moment. What other formats do you consider to be essential according to your experience?
_________________
Vitaliy Mokosiy
CTO
Atola Technology 

raydenvm
Member
 
 
  

Re: Convert from Encase to DD/Raw

Post Posted: Tue Sep 12, 2017 9:05 am

- raydenvm

As for supported target images, there are just a raw image and E01 at the moment. What other formats do you consider to be essential according to your experience?

Nothing actually *needed* right now, and between you and me I would personally be happy just with the RAW format, but if I were you I would keep an eye on AFF4, the real issue being that if the people at Guidance decide to change anything in the EWF (or EWF-X) format a new Tower of Babel Shocked might happen.

The whole idea of using an undocumented (and recreated through this or that reverse-engineering method) proprietary format (even if it is a de facto standard) as only format for non-raw images is - as I see it - a problem.

jaclaz
_________________
- In theory there is no difference between theory and practice, but in practice there is. - 

jaclaz
Senior Member
 
 

Page 2 of 2
Go to page Previous  1, 2