Join Us!

How to write E01 co...
 
Notifications
Clear all

How to write E01 contents to the drive  

  RSS
Thomass30
(@thomass30)
Active Member

Hello
I have E01 file which is the binary copy of microsd card.
Can someone give me a clue how to write contents of this E01 file to another microsd card ?

(I don't mean mounting e01 for example via FTK Imager and manually copy the contents of it)

Quote
Posted : 31/10/2018 9:22 am
hommy0
(@hommy0)
Member

Hi,
So I assume you mean you have an E01 and wish to recreate the SD card from it.

Depends on the tools you have available, EnCase has the functionality to restore the physical device or logical volume from an E01.

ReplyQuote
Posted : 31/10/2018 9:53 am
Thomass30
(@thomass30)
Active Member

hommy0 - Yes exactly.

Unfortunately I dont have EnCase.

Any free tool to do that ?

ReplyQuote
Posted : 31/10/2018 9:55 am
AmNe5iA
(@amne5ia)
Active Member

X-Ways Forensics allows you to restore an E01 back onto a HDD/USB/SDCard etc. as does EnCase.

If you use linux you can use libewf to do it for free.

$ mkdir temp
$ ewfmount xxx.E01 temp
$ sudo cp temp/ewf1 /dev/sdb && sync
$ sudo umount temp
$ rmdir temp
where xxx.E01 is your E01 files and /dev/sdb is whatever the SD Card block device is on your computer.

ReplyQuote
Posted : 31/10/2018 10:01 am
Thomass30
(@thomass30)
Active Member

Great I will check this
Thank you

ReplyQuote
Posted : 31/10/2018 12:54 pm
azrael
(@azrael)
Senior Member

As you've said

(I don't mean mounting e01 for example via FTK Imager and manually copy the contents of it)

Assuming on Linux that you have libewf installed (as per AmNe5iA's example), you can use the included utility ewfexport

Run this against the E01 and the utility will prompt you for the other details - choose to export as RAW and then you can use dd to copy it to an SD card in the normal way ( dd if=image.dd of=/dev/sd? )

ReplyQuote
Posted : 31/10/2018 8:31 pm
AmNe5iA
(@amne5ia)
Active Member

Hmm

I've never used ewfexport, but I don't see the point in copying it out as a raw file and then copying that raw file to the sd card. Might as well cut out the middle man.
$ sudo ewfexport -t /dev/sdb xxx.E01should work in place of the commands i wrote above.

ReplyQuote
Posted : 01/11/2018 9:12 am
jaclaz
(@jaclaz)
Community Legend

Just in case, under Windows, Clonedisk
http//labalec.fr/erwan/?page_id=42

has now the option to read EWF files and either convert them to RAW or directly write them to device
http//labalec.fr/erwan/?p=1235

jaclaz

ReplyQuote
Posted : 01/11/2018 12:52 pm
ZeroOneZero
(@zeroonezero)
New Member

FTK has a restore feature that writes an image to a disk. Doesn't even matter what size. It has an option to write the remaining size as 0s.

ReplyQuote
Posted : 23/11/2018 7:46 pm
Share: