How to write E01 contents to the drive

Hi,
So I assume you mean you have an E01 and wish to recreate the SD card from it.

Depends on the tools you have available, EnCase has the functionality to restore the physical device or logical volume from an E01.

hommy0 - Yes exactly.

Unfortunately I dont have EnCase.

Any free tool to do that ?

X-Ways Forensics allows you to restore an E01 back onto a HDD/USB/SDCard etc. as does EnCase.

If you use linux you can use libewf to do it for free.

$ mkdir temp
$ ewfmount xxx.E01 temp
$ sudo cp temp/ewf1 /dev/sdb && sync
$ sudo umount temp
$ rmdir tempwhere xxx.E01 is your E01 files and /dev/sdb is whatever the SD Card block device is on your computer.

Great I will check this
Thank you

As you've said

(I don't mean mounting e01 for example via FTK Imager and manually copy the contents of it)

Assuming on Linux that you have libewf installed (as per AmNe5iA's example), you can use the included utility ewfexport …

Run this against the E01 and the utility will prompt you for the other details - choose to export as RAW and then you can use dd to copy it to an SD card in the normal way ( dd if=image.dd of=/dev/sd? )

Hmm

I've never used ewfexport, but I don't see the point in copying it out as a raw file and then copying that raw file to the sd card. Might as well cut out the middle man.
$ sudo ewfexport -t /dev/sdb xxx.E01should work in place of the commands i wrote above.

Just in case, under Windows, Clonedisk
http//labalec.fr/erwan/?page_id=42

has now the option to read EWF files and either convert them to RAW or directly write them to device
http//labalec.fr/erwan/?p=1235

jaclaz

FTK has a restore feature that writes an image to a disk. Doesn't even matter what size. It has an option to write the remaining size as 0s.