Good Afternoon,
I was imaging a drive with Paladin (E01 format) and the source drive crashed and did not finish imaging. I have about 250GB of data. Is there anyway to load that partial image into EnCase or FTK. If not how can I get at the data?
Thanks
See if any among XMount (linux) or Arsenal Image Mounter (windows) or any other tool making use of libewf can mount the partial image and then plainly dd it to a new image.
Otherwise, still within the ewflib
http//
you may want to try ewfexport/ewfrecover.
Maybe (cannot say if it is possible with your file) it could be possible to add bytes to your image (as if they were empty sectors on the source disk) to "complete" the image.
jaclaz
I would expect if you convert the file to a DD format, then you have a choice of many recovery programs to see what data has been captured.
Open the image in Encase imager, it will zero out the missing parts, then acquire/export a new image from that.
We do it all the time, email me directly if you have questions. derek@ellington.net
Xways should be able to work with a partial image as well if you have access to it. You will get an error message on loading that the image size appears incorrect, but then you can work with it as normal.
E01 partial drive image is usually not too stable. We've had success when processing such images with