Just a quick question I am having a stupid problem with. I can not load an EXT4 E01 file into EnCase7. And by that I mean, it it happy to receive it, but then I just get a slash [ / ] for the file system / data.
I've not used 7 before and I'm fully aware that 6.xx doesn't support it (I have trawled the GS forums)
I have it working in FTK, which is fine, however I want to mount it as a network share to run Blade over unallocated and I can't find anything else that does it. FTK mounts unallocated as a million separate files and folders evil
I figured it would be simple to load it into 7 and mount it. Turns out its not.
The only thing I can think of would be the fact that it was originally encrypted. But we unencrypted it, imaged it to DD, then loaded it into FTK 4.0 and everything for there, happy days. So why can't EnCase 7 see it?
As mentioned, like the rest of the whole forensic community across the world, I am not using 7 (and possibly wont be for a long long time!) But it would be perfect to do this one little job. Am I missing something blindingly obvious?
Thanks.
Oh, PS. I tried loading the DD as a Raw Image to the same affect!
A couple of options spring to mind
I believe FTK Imager will mount images, plus the tool is free.
Thanks, I tried FTK Imager, but it mounts unallocated as thousands of separate files, which I can not run Blade over as it would take months and months. EnCase when you mount as a network share will give you one big unallocated cluster for you to use, very handy and easier. The only other option is to run blade over the entire E01 and just see what I see, it will just take a lot longer.
Thanks for the reply.
Am very disappointed in EnCase 7. I can understand now why it gets so much hate! roll