Hello
I have E01 file which is the binary copy of microsd card.
Can someone give me a clue how to write contents of this E01 file to another microsd card ?
(I don't mean mounting e01 for example via FTK Imager and manually copy the contents of it)
Hi,
So I assume you mean you have an E01 and wish to recreate the SD card from it.
Depends on the tools you have available, EnCase has the functionality to restore the physical device or logical volume from an E01.
hommy0 - Yes exactly.
Unfortunately I dont have EnCase.
Any free tool to do that ?
X-Ways Forensics allows you to restore an E01 back onto a HDD/USB/SDCard etc. as does EnCase.
If you use linux you can use libewf to do it for free.
$ mkdir temp
where xxx.E01 is your E01 files and /dev/sdb is whatever the SD Card block device is on your computer.
$ ewfmount xxx.E01 temp
$ sudo cp temp/ewf1 /dev/sdb && sync
$ sudo umount temp
$ rmdir temp
Great I will check this
Thank you
As you've said
(I don't mean mounting e01 for example via FTK Imager and manually copy the contents of it)
Assuming on Linux that you have libewf installed (as per AmNe5iA's example), you can use the included utility
Run this against the E01 and the utility will prompt you for the other details - choose to export as RAW and then you can use dd to copy it to an SD card in the normal way ( dd if=image.dd of=/dev/sd? )
Hmm
I've never used ewfexport, but I don't see the point in copying it out as a raw file and then copying that raw file to the sd card. Might as well cut out the middle man.$ sudo ewfexport -t /dev/sdb xxx.E01
should work in place of the commands i wrote above.
Just in case, under Windows, Clonedisk
http//
has now the option to read EWF files and either convert them to RAW or directly write them to device
http//
jaclaz
FTK has a restore feature that writes an image to a disk. Doesn't even matter what size. It has an option to write the remaining size as 0s.