ddcomputer-forensicsdiskimage

How can I convert E01 image file to dd image file?


I'm working on forensics tools and I have Encase E01 type image file. I would like to analyze this image by using other tools. However, those tools such as tsk_recover doesn't accept E01 file type as input. So, I need to convert E01 image file to dd format without any alteration.


Solution

  • tsk_recover (and all of The Sleuth Kit and Autopsy tools) support E01 if you compile it with libewf (http://sourceforge.net/projects/libewf/). If you want the raw image though, libewf has tools to do the conversion and you can use 'img_cat' in TSK to do it (but it requires you to have compiled in libewf).