Partial Drive Image
I was imaging a drive with Paladin (E01 format) and the source drive crashed and did not finish imaging. I have about 250GB of data. Is there anyway to load that partial image into EnCase or FTK. If not how can I get at the data?
See if any among XMount (linux) or Arsenal Image Mounter (windows) or any other tool making use of libewf can mount the partial image and then plainly dd it to a new image.
Otherwise, still within the ewflib
you may want to try ewfexport/ewfrecover.
Maybe (cannot say if it is possible with your file) it could be possible to add bytes to your image (as if they were empty sectors on the source disk) to "complete" the image.
I would expect if you convert the file to a DD format, then you have a choice of many recovery programs to see what data has been captured.
Xways should be able to work with a partial image as well if you have access to it. You will get an error message on loading that the image size appears incorrect, but then you can work with it as normal.
E01 partial drive image is usually not too stable. We've had success when processing such images with Belkasoft Evidence Center, but it is about 50/50 I would say. So I suggest you try to import E01 image first, and, if not, I agree that the best option would be to convert it to DD image, then you are very likely to be able to extract the data out if successfully. Belkasoft Evidence Center will do it automatically for you, and then you can export the findings into EnCase if you want or have to, since the two products are integrated (webinar demonstrating the usage of both tools together https://www.guidancesoftware.com/resources/Pages/webinars/Enhancing-Digital-Investigations-with-Belkasoft.aspx )