±Forensic Focus Partners

Become an advertising partner

±Your Account


Username
Password

Forgotten password/username?

Site Members:

New Today: 0 Overall: 33057
New Yesterday: 5 Visitors: 166

±Follow Forensic Focus

Forensic Focus Facebook PageForensic Focus on TwitterForensic Focus LinkedIn GroupForensic Focus YouTube Channel

RSS feeds: News Forums Articles

±Latest Articles

RSS Feed Widget

±Latest Webinars

Convert from Encase to DD/Raw

Forensic software discussion (commercial and open source/freeware). Strictly no advertising.
Reply to topicReply to topic Printer Friendly Page
Forum FAQSearchView unanswered posts
Go to page 1, 2  Next 
  

Convert from Encase to DD/Raw

Post Posted: Tue Jul 17, 2007 9:50 am

Hi

I need a program which can convert encase files to dd or raw format. I know FTK Image and Mount-Image Pro can do this, but I need something that wil work in linux.

A commando based version would be best, and I am running Fedora Core 7 on 64 bit.

Thank you  

Christopherkn
Newbie
 
 
  

Re: Convert from Encase to DD/Raw

Post Posted: Tue Jul 17, 2007 10:44 am

Have a look at :

www.uitwisselplatform....ts/libewf/

And this thread :

www.forensicfocus.com/...opic&t=598

Azrael.
_________________
--
Azrael
-- 

azrael
Senior Member
 
 
  

Re: Convert from Encase to DD/Raw

Post Posted: Sat Sep 09, 2017 1:17 pm

Ok, really old thing...but its possible the best place!

We have the problem, that ZiuZ always fail with E01 files. Now we find out, that dd works fine.... We also use Atola Hardware, this can create E01 and IMG at same time, but no dd..... ok, i will open E01 with FTK and export as dd.....but FTK can't open Atola E01 files and often also EnCase E01 files not.

Is there another tool, that can create dd from an E01 file?  

apfelkraft.ch
Member
 
 
  

Re: Convert from Encase to DD/Raw

Post Posted: Sat Sep 09, 2017 1:46 pm

- apfelkraft.ch
Ok, really old thing...but its possible the best place!

We have the problem, that ZiuZ always fail with E01 files. Now we find out, that dd works fine.... We also use Atola Hardware, this can create E01 and IMG at same time, but no dd..... ok, i will open E01 with FTK and export as dd.....but FTK can't open Atola E01 files and often also EnCase E01 files not.

Is there another tool, that can create dd from an E01 file?


I am not sure to understand.

Which format is the "IMG" if not a "raw" dd one?

Under Linux:
www.pinguin.lu/xmount

Under Windows (apart FTK imager):
Mount with Arsenal Image Mounter:
arsenalrecon.com/weapo...e-mounter/
image to .dd using dd or any other imaging tool

jaclaz
_________________
- In theory there is no difference between theory and practice, but in practice there is. - 

jaclaz
Senior Member
 
 
  

Re: Convert from Encase to DD/Raw

Post Posted: Sat Sep 09, 2017 2:04 pm

Thank You, Arsenal was new for me....i think with the demoversion isn't possible? I need it for windows.... Will buy, but after testing. In the demoversion there is no export?

i am not sure witch IMG files atola creates....but it is not the same like dd....ziuz can't read the IMG files from Atola.  

apfelkraft.ch
Member
 
 
  

Re: Convert from Encase to DD/Raw

Post Posted: Sun Sep 10, 2017 4:47 am

- apfelkraft.ch
Thank You, Arsenal was new for me....i think with the demoversion isn't possible? I need it for windows.... Will buy, but after testing. In the demoversion there is no export?

i am not sure witch IMG files atola creates....but it is not the same like dd....ziuz can't read the IMG files from Atola.


No, the free version should work the same.
But there is no "export".
The idea is different.

The Arsenal Image Mounter is only a driver that can expose a (virtual) \\.\PhysicalDrive created out of the .E01 (using libewf), and nothing more.

You need your own imaging program (dd, FTK imager, whatever) to image the (virtual) \\.\Physicaldrive created by Arsenal Image Mounter.

Or just examine directly the (virtual) physicaldrive just created.

And AFAIK the ".IMG" an Atola may create is a .dd raw image, provided that you imaged the whole disk (physical).

Maybe - for *whatever* reason - you are experiencing issues in the imaging, and both the .E01 and the .IMG are *somehow* corrupted, or maybe they were some kind of "partial" images. Confused

jaclaz
_________________
- In theory there is no difference between theory and practice, but in practice there is. - 

jaclaz
Senior Member
 
 
  

Re: Convert from Encase to DD/Raw

Post Posted: Sun Sep 10, 2017 9:23 am

Correct, the IMG files works on ziuz...looks like its the same like dd! The E01 is ok, it is also normal that FTK can't read the Atola E01 files....i have often E01 files, that FTK can't read...but autopsy and all other tools have no problem!
Thank you!  

apfelkraft.ch
Member
 
 

Page 1 of 2
Go to page 1, 2  Next