How can I convert E01 image file to dd image file?

dd computer-forensics diskimage
Lorderon picture Lorderon · May 21, 2014 · Viewed 19.8k times · Source

I'm working on forensics tools and I have Encase E01 type image file. I would like to analyze this image by using other tools. However, those tools such as tsk_recover doesn't accept E01 file type as input. So, I need to convert E01 image file to dd format without any alteration.

Answer

Ryan picture Ryan · Nov 24, 2015

FTK Imager from Access Data (http://accessdata.com/product-download) is a free tool that can do many things with several evidence file formats (E01, DD, and AD1), including mounting them logically and converting them to different formats.

You can use it to convert an E01 image to a DD image by:

  • Opening the E01 with FTK Imager
  • Right-clicking on the E01 file in the left 'Evidence Tree'
  • Selecting 'Export Disk Image'
  • 'Add' Image Destination
  • Select 'Raw (dd)' in the popup box, and finish the wizard
  • Hit start and wait for it to finish, then you'll have your DD image

Related questions

dd: How to calculate optimal blocksize?

How do you calculate the optimal blocksize when running a dd? I've researched it a bit and I've not found anything suggesting how this would be accomplished. I am under the impression that a larger blocksize would result in a …

Read More
Using grep to search for hex strings in a file

I have been trying all day to get this to work. Does anyone know how to get grep, or something of the like, to retrieve offsets of hex strings in a file? I have a bunch of hexdumps that I …

Read More
How to create an .IMG image of a disc (sd card) without including free space?

In Linux, we can do dd if=/dev/sdb of=bckup.img but if the disk is of 32GB with only 4GB used, the 32GB image file is waste of space-time. Is there any way or tool to create images …

Read More