±Forensic Focus Partners

Become an advertising partner

±Your Account


Username
Password

Forgotten password/username?

Site Members:

New Today: 0 Overall: 35251
New Yesterday: 4 Visitors: 105

±Follow Forensic Focus

Forensic Focus Facebook PageForensic Focus on TwitterForensic Focus LinkedIn GroupForensic Focus YouTube Channel

RSS feeds: News Forums Articles

±Latest Articles

±Latest Webinars

X-Ways - E01 from EnCase

Forensic software discussion (commercial and open source/freeware). Strictly no advertising.
Reply to topicReply to topic Printer Friendly Page
Forum FAQSearchView unanswered posts
 
  

mrmoo28
Member
 

X-Ways - E01 from EnCase

Post Posted: Sep 29, 15 15:17

Hello,

On the X-Ways website it states:

"Don't use compressed .e01 evidence files created with tools other than X-Ways Forensics (avoid normal or strong compression)"

Does anyone know why? Are there limitations or will X-Ways run slower?

I have several sets of E01 files of Ubuntu servers using XFS, that were created by Linen using Best compression. Most loaded into X-Ways fine but two came up with a message/error in the program pretty much saying the same as above.

Struggling to find anything on the X-Ways website or manual that specifically states why...

Thanks,
Alex  
 
  

minime2k9
Senior Member
 

Re: X-Ways - E01 from EnCase

Post Posted: Sep 29, 15 18:47

It doesn't actually mean don't use them, it is basically saying their compression algorithm is inefficient. Its does mean they will process slower than those created using X-Ways, however I don't think it will be too noticeable and it will still be much faster than using Encase 7  
 
  

EricZimmerman
Senior Member
 

Re: X-Ways - E01 from EnCase

Post Posted: Nov 25, 15 18:21

as minime2k9 stated, its just a warning. X-Ways will process them fine, but most imaging tools are 'stupid' in that they just, for example, try to gzip -9 everything, even when its already compressed. This can make things worse than not compressing at all.  
 
  

NathanC
Newbie
 

Re: X-Ways - E01 from EnCase

Post Posted: Dec 10, 15 14:03

It doesn't make much difference on a decent machine. It is just X-Ways Teutonic poke at Guidance!  
 

Page 1 of 1