Notifications
Clear all
Topic starter
05/07/2017 8:15 pm
Hi all
I have a question restoring an Encase image which consists of multiple files - E01, E02, etc. I understand that I have to open up the E01 in Encase and restore from there. However, will this read from the E02s etc., or how exactly does this work?
Thanks in advance!
05/07/2017 8:38 pm
Typically splitting an image into multiple files (e01, e02…) is common practice in forensic imaging. It helps with large file size issues and offboarding images especially to optical media.
E01 is the leading forensic image file. And the E02, E03, E04…files contain the other remaining data are accounted and verified.
05/07/2017 9:08 pm
EnCase will read from all of the files in the series.