How to write E01 co...
 
Notifications
Clear all

How to write E01 contents to the drive

9 Posts
6 Users
0 Likes
5,707 Views
(@thomass30)
Posts: 110
Estimable Member
Topic starter
 

Hello
I have E01 file which is the binary copy of microsd card.
Can someone give me a clue how to write contents of this E01 file to another microsd card ?

(I don't mean mounting e01 for example via FTK Imager and manually copy the contents of it)

 
Posted : 31/10/2018 9:22 am
(@hommy0)
Posts: 98
Trusted Member
 

Hi,
So I assume you mean you have an E01 and wish to recreate the SD card from it.

Depends on the tools you have available, EnCase has the functionality to restore the physical device or logical volume from an E01.

 
Posted : 31/10/2018 9:53 am
(@thomass30)
Posts: 110
Estimable Member
Topic starter
 

hommy0 - Yes exactly.

Unfortunately I dont have EnCase.

Any free tool to do that ?

 
Posted : 31/10/2018 9:55 am
AmNe5iA
(@amne5ia)
Posts: 173
Estimable Member
 

X-Ways Forensics allows you to restore an E01 back onto a HDD/USB/SDCard etc. as does EnCase.

If you use linux you can use libewf to do it for free.

$ mkdir temp
$ ewfmount xxx.E01 temp
$ sudo cp temp/ewf1 /dev/sdb && sync
$ sudo umount temp
$ rmdir temp
where xxx.E01 is your E01 files and /dev/sdb is whatever the SD Card block device is on your computer.

 
Posted : 31/10/2018 10:01 am
(@thomass30)
Posts: 110
Estimable Member
Topic starter
 

Great I will check this
Thank you

 
Posted : 31/10/2018 12:54 pm
azrael
(@azrael)
Posts: 656
Honorable Member
 

As you've said

(I don't mean mounting e01 for example via FTK Imager and manually copy the contents of it)

Assuming on Linux that you have libewf installed (as per AmNe5iA's example), you can use the included utility ewfexport …

Run this against the E01 and the utility will prompt you for the other details - choose to export as RAW and then you can use dd to copy it to an SD card in the normal way ( dd if=image.dd of=/dev/sd? )

 
Posted : 31/10/2018 8:31 pm
AmNe5iA
(@amne5ia)
Posts: 173
Estimable Member
 

Hmm

I've never used ewfexport, but I don't see the point in copying it out as a raw file and then copying that raw file to the sd card. Might as well cut out the middle man.
$ sudo ewfexport -t /dev/sdb xxx.E01should work in place of the commands i wrote above.

 
Posted : 01/11/2018 9:12 am
jaclaz
(@jaclaz)
Posts: 5133
Illustrious Member
 

Just in case, under Windows, Clonedisk
http//labalec.fr/erwan/?page_id=42

has now the option to read EWF files and either convert them to RAW or directly write them to device
http//labalec.fr/erwan/?p=1235

jaclaz

 
Posted : 01/11/2018 12:52 pm
(@zeroonezero)
Posts: 16
Active Member
 

FTK has a restore feature that writes an image to a disk. Doesn't even matter what size. It has an option to write the remaining size as 0s.

 
Posted : 23/11/2018 7:46 pm
Share: