How can I convert a Ad1 to E01 for Encase analysis. I need this info quickly so any help is appreciated. !
Have you got FTK Imager? That should do it (I think)
Yeah. It will only do a disk converson. This is a logical directory image. I don't think I will be able to do it
From access Data
An AD1 image actually cannot be converted to an E01 image. An AD1 image is a logical image of the contents of a folder. It doesn’t include file slack, deleted files, drive freespace or sector information, so there’s not enough information in it to convert it to a sector image like DD or E01.
I believe that when you begin creating an image in FTK Imager, it will give you a warning explaining the limitations. I know it does in the newer versions at least.
If you need an E01 image as soon as possible, your best bet is to start imaging as an E01 as soon as possible. Let me know if I can help you with anything.
Export all the files from FTK to a wiped volume and from there add the files to Encase and create a Lo1.
Spring got it right.
This is obviously a little (lot) late, but there is a piece of software that now converts AD1 to L01 directly. The software is called Forensic explorer (
this is why you dont FTK =)
Unfortunately it doesn't allow for the conversion in the trial version… (
Hi Can you explain how Forensic explorer does the conversion? I went to there site but could not find any info on the conversion. Albeit I searched quickly, but I have a customer who would buy it today if it worked…