Forensic Dossier from LogiCube supports E01

Sorry to kick this old topic - but I thought this would be a more appropriate location than in a new one.

A couple of weeks ago we were testing our new Logicube Dossiers and found that the .E01 images we created would not load in FTK Imager. We found this blog posting which mentions

The Dossier boasts that it can image in .E01 format, but there should be some disclaimers to that. The .E01 format used by the Dossier is only compatible with EnCase, and you will not get a matching hash value in FTK. Also, if you pull your .E01 image into FTK, most likely you will never be able to pull it into EnCase, it somehow corrupts it (the two tools use different .E01 formats). I recommend imaging the drive in DD format using the Dossier, then re-acquire the DD (raw) image as an .E01 inside EnCase (raw images have a tendency to become corrupt inside EnCase).

We also sent in a support ticket to ask if this was indeed what we were experiencing, and Logicube confirmed

Currently we only support Encase 6.0 and higher, although some our customers have been able to open the E01 images with FTK. We are currently working on software update that will support E01 with FTK. I'm sorry I don't have a release date.

On my obvious follow-up question why such quite essential information is not listed in the manual, they only assured me that the next version would include this compatibility information.

As this new version of the manual has not yet been released, and other people might experience the same problems, I thought some extra attention to this information could be helpful.

On a less diplomatic note if the best they could come up with is a vendor-specific implementation of the E01-format (quite an achievement in itself as I don't know any other tools that managed to do this…), they could just as well have saved the effort, as you now still have to re-process your images to use them in other tools.

I would think the reasons for not mentioning it would be no sales.

The statement about your hash values wont match if you open it in FTK alone causes even a novice to step back and say whoa.

Sorry to kick this old topic - but I thought this would be a more appropriate location than in a new one.

A couple of weeks ago we were testing our new Logicube Dossiers and found that the .E01 images we created would not load in FTK Imager. We found this blog posting which mentions

The Dossier boasts that it can image in .E01 format, but there should be some disclaimers to that. The .E01 format used by the Dossier is only compatible with EnCase, and you will not get a matching hash value in FTK. Also, if you pull your .E01 image into FTK, most likely you will never be able to pull it into EnCase, it somehow corrupts it (the two tools use different .E01 formats). I recommend imaging the drive in DD format using the Dossier, then re-acquire the DD (raw) image as an .E01 inside EnCase (raw images have a tendency to become corrupt inside EnCase).

We also sent in a support ticket to ask if this was indeed what we were experiencing, and Logicube confirmed

Currently we only support Encase 6.0 and higher, although some our customers have been able to open the E01 images with FTK. We are currently working on software update that will support E01 with FTK. I'm sorry I don't have a release date.

On my obvious follow-up question why such quite essential information is not listed in the manual, they only assured me that the next version would include this compatibility information.

As this new version of the manual has not yet been released, and other people might experience the same problems, I thought some extra attention to this information could be helpful.

On a less diplomatic note if the best they could come up with is a vendor-specific implementation of the E01-format (quite an achievement in itself as I don't know any other tools that managed to do this…), they could just as well have saved the effort, as you now still have to re-process your images to use them in other tools.