data carving tools

How big is the image and how much RAM and Disk space do you have?

Image carving may need lots of temp space as well as additional export space depending on the size of the image and/or unallocated space.

Also you may want to look at any config parameters in your carving requirements like max export size to help prevent from carving chunks that are too large.

i have 16 GB ram

500GB SSD
2TB data drive
1TB back up drive

Disk image orginally 2TB compression 9 whiles imaging it = 254,731,437 KB

I would just use ImDisk to mount the Encase image, then you can use all sorts of file carving software against it. My favorite is R-Studio because you can create your own custom XML file signatures for any types not already supported. But, that's not a free option.

As a free option you can try photorec which comes with testdisk from CGSecurity. Or you can try one of the other free data recovery tools such as Recuva Free.

Also - as a side note - since you are doing "carving from RAW" there is not any problem in making segments of the image and analyze each separately.

Of course you may "lose" 1 document (hypothetically carvable) that happens to lie where you make the division in two segment, while 2 Tb may be "a lot", you could use 4 segments, I am pretty sure that scalpel can deal with a 512 Gb segment, so all in all at the most you risk to not find 3 files, and you can anyway make a further three - say - 10 Gb segments covering 5 Gb before and 5 Gb after the dividing point and analyze those.

@jaredDM
I would rather use the Arsenal Image Mounter (that mounts the whole disk), instead of IMDISK (that can only mount volume(s)).
The Author, is the same Olof Lagerkvist, that developed for Arsenal Recon the new Image Mounter exactly because IMDISK had some limitations for forensic use
https://arsenalrecon.com/apps/image-mounter/

jaclaz

I would use bulk_extractor myself. Try it against the EWF image and the mounted image.

Or try Foremost against the raw image. Usage example

root@kali~# foremost -t doc,jpg,pdf,xls -i image.dd
Processing image.dd
|*|
root@kali~# ls output/
audit.txt jpg pdf