X-Ways - E01 from EnCase
On the X-Ways website it states
"Don't use compressed .e01 evidence files created with tools other than X-Ways Forensics (avoid normal or strong compression)"
Does anyone know why? Are there limitations or will X-Ways run slower?
I have several sets of E01 files of Ubuntu servers using XFS, that were created by Linen using Best compression. Most loaded into X-Ways fine but two came up with a message/error in the program pretty much saying the same as above.
Struggling to find anything on the X-Ways website or manual that specifically states why…
It doesn't actually mean don't use them, it is basically saying their compression algorithm is inefficient. Its does mean they will process slower than those created using X-Ways, however I don't think it will be too noticeable and it will still be much faster than using Encase 7
as minime2k9 stated, its just a warning. X-Ways will process them fine, but most imaging tools are 'stupid' in that they just, for example, try to gzip -9 everything, even when its already compressed. This can make things worse than not compressing at all.
It doesn't make much difference on a decent machine. It is just X-Ways Teutonic poke at Guidance!