Winhex - split imag...
 
Notifications
Clear all

Winhex - split image

9 Posts
6 Users
0 Reactions
1,753 Views
jimmy
(@jimmy)
Eminent Member
Joined: 17 years ago
Posts: 47
Topic starter  

I have 250GB of imaged data using ICS SOLO with fragment size as 1GB each. I want to know how can we open these files in WinHex without using the option concatenate.


   
Quote
(@larryd)
Active Member
Joined: 17 years ago
Posts: 13
 

Are you using WinHex or X-ways? If you are using X-Ways then you just tell it to open an image and you select the first file.


   
ReplyQuote
(@yisun)
Active Member
Joined: 15 years ago
Posts: 9
 

You can use Mount Image Pro to mount these e0* files as a physical drive and then use Winhex to open this Physical Drive.


   
ReplyQuote
(@douglasbrush)
Prominent Member
Joined: 16 years ago
Posts: 812
 

You can use Mount Image Pro to mount these e0* files as a physical drive and then use Winhex to open this Physical Drive.

Yes, no, maybe. MIP will open split file disk images. However I wasn't aware that the Solo III could do EnCase split files. That came out in version IV.

I have 250GB of imaged data using ICS SOLO with fragment size as 1GB each. I want to know how can we open these files in WinHex without using the option concatenate.

What are you trying to do?


   
ReplyQuote
(@yisun)
Active Member
Joined: 15 years ago
Posts: 9
 

You can use Mount Image Pro to mount these e0* files as a physical drive and then use Winhex to open this Physical Drive.

Yes, no, maybe. MIP will open split file disk images. However I wasn't aware that the Solo III could do EnCase split files. That came out in version IV.

I mean, just need to choose the first E01, MIP will mount all E0* files as a single physical disk, is there anything wrong?


   
ReplyQuote
(@brede)
Trusted Member
Joined: 20 years ago
Posts: 64
 

I have 250GB of imaged data using ICS SOLO with fragment size as 1GB each. I want to know how can we open these files in WinHex without using the option concatenate.

it may not be Expert Witness File(E0x extension) but simple RAW image in files with extension 001-0x. Just add image by adding first image file, should work.


   
ReplyQuote
(@douglasbrush)
Prominent Member
Joined: 16 years ago
Posts: 812
 

You can use Mount Image Pro to mount these e0* files as a physical drive and then use Winhex to open this Physical Drive.

Yes, no, maybe. MIP will open split file disk images. However I wasn't aware that the Solo III could do EnCase split files. That came out in version IV.

I mean, just need to choose the first E01, MIP will mount all E0* files as a single physical disk, is there anything wrong?

Nope. Just that if the split image was made on a Solo III then the segments will not be *.e01 files. As brede pointed out the raw image can be opened in MIP with first segment of the file. MIP does support EWF as well as many others.

However, if split DD files, the image can be mounted in ImDisk - http//www.ltr-data.se/opencode.html#ImDisk or MIP depending on needs and likes.


   
ReplyQuote
(@yisun)
Active Member
Joined: 15 years ago
Posts: 9
 

You can use Mount Image Pro to mount these e0* files as a physical drive and then use Winhex to open this Physical Drive.

Yes, no, maybe. MIP will open split file disk images. However I wasn't aware that the Solo III could do EnCase split files. That came out in version IV.

I mean, just need to choose the first E01, MIP will mount all E0* files as a single physical disk, is there anything wrong?

Nope. Just that if the split image was made on a Solo III then the segments will not be *.e01 files. As brede pointed out the raw image can be opened in MIP with first segment of the file. MIP does support EWF as well as many others.

However, if split DD files, the image can be mounted in ImDisk - http//www.ltr-data.se/opencode.html#ImDisk or MIP depending on needs and likes.

My fault, I thought it was Solo 4 lol
Many thanks~


   
ReplyQuote
ecophobia
(@ecophobia)
Estimable Member
Joined: 17 years ago
Posts: 127
 

Open first dd image segment in X-ways and click 'interpret as disk'.


   
ReplyQuote
Share: