Hello!
Please can someone explain to me what is the difference between E01, S01 and RAW formats image?
Thanks
Joel
RAW or DD images just contain the data from the original source, and nothing else. Any hash data etc is usually stored in a separate log file that is generally stored with the image file.
EnCase image format includes a separate hash for each segment, and the hash file and certain information about the image - including information entered by the examiner - is stored inside the image files themselves. Hence an E01 is more than just the image, it also contains metadata relating to the image file.
I'll leave S01 to someone else to explain.
Thank you Patrick4n6!
Well explained.
Thanks again.
Joel
A short description can be found, here
http//
A short description can be found, here
http//
www.cs.harvard.edu/malan/publications/aff.pdf
Thank you!
Very helpful.
Joel