Copying a mounted E01 file to a raw image in Slackware

Jossie · 10-24-2019, 02:16 PM

I have a container with a split e01 - I have this mounted using ewfmount in location /mnt/Encase - i can now see the ewf1 file mounted in this location.

How do I now create a raw image of these files from this location please?

allend · 10-25-2019, 11:43 PM

This is new to me, but the procedure seems straightforward. Run the Sleuthkit (available at SlackBuilds .org if you do not already have it installed) tool mmls to get sector size and partition offsets, then use losetup to mount the partition of interest.
All taken from under the heading Mounting the raw image to a loopback device here.

Jossie · 10-29-2019, 11:12 AM

Sorry should have specified sleuthkit commands not allowed - managed to sort it but thanks for the reply.