Difference between ...
 
Notifications
Clear all

Difference between images type

5 Posts
3 Users
0 Reactions
12 K Views
(@joeltharas)
Trusted Member
Joined: 16 years ago
Posts: 53
Topic starter  

Hello!

Please can someone explain to me what is the difference between E01, S01 and RAW formats image?

Thanks

Joel


   
Quote
(@patrick4n6)
Honorable Member
Joined: 16 years ago
Posts: 650
 

RAW or DD images just contain the data from the original source, and nothing else. Any hash data etc is usually stored in a separate log file that is generally stored with the image file.

EnCase image format includes a separate hash for each segment, and the hash file and certain information about the image - including information entered by the examiner - is stored inside the image files themselves. Hence an E01 is more than just the image, it also contains metadata relating to the image file.

I'll leave S01 to someone else to explain.


   
ReplyQuote
(@joeltharas)
Trusted Member
Joined: 16 years ago
Posts: 53
Topic starter  

Thank you Patrick4n6!

Well explained.

Thanks again.
Joel


   
ReplyQuote
(@seanmcl)
Honorable Member
Joined: 19 years ago
Posts: 700
 

A short description can be found, here

http//www.cs.harvard.edu/malan/publications/aff.pdf


   
ReplyQuote
(@joeltharas)
Trusted Member
Joined: 16 years ago
Posts: 53
Topic starter  

A short description can be found, here

http//www.cs.harvard.edu/malan/publications/aff.pdf

Thank you!

Very helpful.

Joel


   
ReplyQuote
Share: