FTK Imager e01 (ewf) format restoration

Marc,

If you have X-Ways available, the Restore Image option is available from the File menu and accepts E01 files as input.

You can also do this in linux using something like mount_ewf.py to mount the E01 as a raw image and dd to write the raw image to your original drive.

HTH

Marc,

If you have X-Ways available, the Restore Image option is available from the File menu and accepts E01 files as input.

You can also do this in linux using something like mount_ewf.py to mount the E01 as a raw image and dd to write the raw image to your original drive.

HTH

Thanks, that helps.

Marc,
You can also do this in linux using something like mount_ewf.py to mount the E01 as a raw image and dd to write the raw image to your original drive.

More
http//computer-forensics.sans.org/blog/2011/11/28/digital-forensic-sifting-mounting-ewf-or-e01-evidence-image-files

jaclaz