±Forensic Focus Partners

Become an advertising partner

±Your Account


Username
Password

Forgotten password/username?

Site Members:

New Today: 1 Overall: 35119
New Yesterday: 3 Visitors: 219

±Follow Forensic Focus

Forensic Focus Facebook PageForensic Focus on TwitterForensic Focus LinkedIn GroupForensic Focus YouTube Channel

RSS feeds: News Forums Articles

±Latest Articles

±Latest Webinars

How to write E01 contents to the drive

Computer forensics discussion. Please ensure that your post is not better suited to one of the forums below (if it is, please post it there instead!)
Reply to topicReply to topic Printer Friendly Page
Forum FAQSearchView unanswered posts
Go to page 1, 2  Next 
  

How to write E01 contents to the drive

Post Posted: Wed Oct 31, 2018 3:22 am

Hello
I have E01 file which is the binary copy of microsd card.
Can someone give me a clue how to write contents of this E01 file to another microsd card ?

(I don't mean mounting e01 for example via FTK Imager and manually copy the contents of it)  

Thomass30
Senior Member
 
 
  

Re: How to write E01 contents to the drive

Post Posted: Wed Oct 31, 2018 3:53 am

Hi,
So I assume you mean you have an E01 and wish to recreate the SD card from it.

Depends on the tools you have available, EnCase has the functionality to restore the physical device or logical volume from an E01.  

hommy0
Member
 
 
  

Re: How to write E01 contents to the drive

Post Posted: Wed Oct 31, 2018 3:55 am

hommy0 - Yes exactly.

Unfortunately I dont have EnCase.

Any free tool to do that ?  

Thomass30
Senior Member
 
 
  

Re: How to write E01 contents to the drive

Post Posted: Wed Oct 31, 2018 4:01 am

X-Ways Forensics allows you to restore an E01 back onto a HDD/USB/SDCard etc. as does EnCase.

If you use linux you can use libewf to do it for free.

Code:
$ mkdir temp
$ ewfmount xxx.E01 temp
$ sudo cp temp/ewf1 /dev/sdb && sync
$ sudo umount temp
$ rmdir temp
where xxx.E01 is your E01 files and /dev/sdb is whatever the SD Card block device is on your computer.  

AmNe5iA
Senior Member
 
 
  

Re: How to write E01 contents to the drive

Post Posted: Wed Oct 31, 2018 6:54 am

Great I will check this
Thank you  

Thomass30
Senior Member
 
 
  

Re: How to write E01 contents to the drive

Post Posted: Wed Oct 31, 2018 2:31 pm

As you've said:
(I don't mean mounting e01 for example via FTK Imager and manually copy the contents of it)


Assuming on Linux that you have libewf installed (as per AmNe5iA's example), you can use the included utility ewfexport ...

Run this against the E01 and the utility will prompt you for the other details - choose to export as RAW and then you can use dd to copy it to an SD card in the normal way ( dd if=image.dd of=/dev/sd? )
_________________
--
Azrael
-- 

azrael
Senior Member
 
 
  

Re: How to write E01 contents to the drive

Post Posted: Thu Nov 01, 2018 3:12 am

Hmm

I've never used ewfexport, but I don't see the point in copying it out as a raw file and then copying that raw file to the sd card. Might as well cut out the middle man.
Code:
$ sudo ewfexport -t /dev/sdb xxx.E01
should work in place of the commands i wrote above.  

AmNe5iA
Senior Member
 
 

Page 1 of 2
Go to page 1, 2  Next