LinuxQuestions.org

LinuxQuestions.org (/questions/)
-   Linux - Newbie (https://www.linuxquestions.org/questions/linux-newbie-8/)
-   -   Copying a mounted E01 file to a raw image in Slackware (https://www.linuxquestions.org/questions/linux-newbie-8/copying-a-mounted-e01-file-to-a-raw-image-in-slackware-4175663102/)

Jossie 10-24-2019 02:16 PM

Copying a mounted E01 file to a raw image in Slackware
 
I have a container with a split e01 - I have this mounted using ewfmount in location /mnt/Encase - i can now see the ewf1 file mounted in this location.

How do I now create a raw image of these files from this location please?

allend 10-25-2019 11:43 PM

This is new to me, but the procedure seems straightforward. Run the Sleuthkit (available at SlackBuilds .org if you do not already have it installed) tool mmls to get sector size and partition offsets, then use losetup to mount the partition of interest.
All taken from under the heading Mounting the raw image to a loopback device here.

Jossie 10-29-2019 11:12 AM

Sorry should have specified sleuthkit commands not allowed - managed to sort it but thanks for the reply.


All times are GMT -5. The time now is 06:15 AM.