Hi Wilson,
Can you email the conversion software (encase to dd) to my email account at inlsclb1@starhub.net.sg ?
Thanks
Steven
Go to the AccessData site and get the free copy of FTK Imager Lite. I've used that in the past.
Craig;
PLease make sure you post the link to that tool when it's released. I could have used it a couple of times recently.
Bill
>EnCase evidence files to a consolidated dd image file
You cn do that in EnCase. Load up the evidence without mounting the file system. Then go to the text/hex pane and export the file to the file. also check the "Append to existing file" checkbox.
Afterwards md5 that dd and comapre with the EnCase hash.
(if you have one e01 file)
You can thus combine any number of files.
Nik
You can use ewfexport, it comes with libewf. There are some other tools to manipulate EWF-Files in the package (create, verify, etc.)
See https://