X-Ways - E01 from E...
 
Notifications
Clear all

X-Ways - E01 from EnCase  

  RSS
mrmoo28
(@mrmoo28)
New Member

Hello,

On the X-Ways website it states

"Don't use compressed .e01 evidence files created with tools other than X-Ways Forensics (avoid normal or strong compression)"

Does anyone know why? Are there limitations or will X-Ways run slower?

I have several sets of E01 files of Ubuntu servers using XFS, that were created by Linen using Best compression. Most loaded into X-Ways fine but two came up with a message/error in the program pretty much saying the same as above.

Struggling to find anything on the X-Ways website or manual that specifically states why…

Thanks,
Alex

Quote
Posted : 29/09/2015 10:17 pm
minime2k9
(@minime2k9)
Active Member

It doesn't actually mean don't use them, it is basically saying their compression algorithm is inefficient. Its does mean they will process slower than those created using X-Ways, however I don't think it will be too noticeable and it will still be much faster than using Encase 7

ReplyQuote
Posted : 30/09/2015 1:47 am
EricZimmerman
(@ericzimmerman)
Active Member

as minime2k9 stated, its just a warning. X-Ways will process them fine, but most imaging tools are 'stupid' in that they just, for example, try to gzip -9 everything, even when its already compressed. This can make things worse than not compressing at all.

ReplyQuote
Posted : 26/11/2015 12:21 am
NathanC
(@nathanc)
New Member

It doesn't make much difference on a decent machine. It is just X-Ways Teutonic poke at Guidance!

ReplyQuote
Posted : 10/12/2015 8:03 pm
Share: