What version are you using? As of version 20120715 support for EWF version 2 (.Ex01 and .Lx01) was added.
Also, ewfexport, exports storage media data in EWF files to (split) RAW format or a specific version of EWF files. In your first post you asked how to mount an Ex01, for that you would use ewfmount, which uses FUSE to mount EWF files.
Posted: Mon Mar 07, 2016 4:49 am Post subject: Re: Open an Encase image of a CD
I have a image (file.Ex01) of a CD.
How can I mount it?
I tryed with FTK imager but the results is drive with an unrecognized file system.
You can have at least two different types of image of a CD: the 'raw' (or physical) image, which has 2352-byte sectors, and the 'user' image, which has 2048-byte sectors.
You have to know which you are working with.
Next, as you leave 'CD' completely unqualified, there's no way to know if you are referring to CD-DA (audio), CD-ROM, CD-R, and so on and so forth. It matters, because 'mounting' presumes a file system.
Next, if we assume a data-related CD format, you can have multiple file systems. ISO 9660 is one, but there are others. And your mounting solution have better support the one actually present.
Do you know that it does? If you have an image from a HFS+ image, and mount it on a Windows system ... you won't succeed, unless you have some software that can do that.
Look at the image: is it an ISO 9660 volume? Or some other file system? Or is it something that cannot be mounted at all? If it is mountable, does your solution support that kind of file system?
But ... if file(1) tells you that it's an ISO-9660 image, it probably is one. If so, it's not any EWF or e01 or Ex01 format, as they have their own file headers, and would most likely be identified as such by file(1).
I might download and compile the disktype tool from Sourceforge, and check what it says. If it also says 'iso-9660', you don't have an EnCase file at all. You have an iso image, and should use a mount utility for that format.
If you know the ISO 9660 format well, you can eyeball it. But if you don't, disktype is probably the best tool you can use.
the result of file command is
ISO 9660 CD-ROM filesystem data (raw 2352 byte sectors)
That is as it says, a 'raw' CD image. The ISO file system is inside the raw sectors, and you need to strip away the 'outside'stuff.
As far as I know, EnCase can't cope with that. But I'm not expert on the latest version (7).
ISOBuster can do it. (Though I'm not 100% sure about if it does so also in the free version.) I've done it with CloneCD raw images and IsoBuster -- you may have to rename the image file to *.img or *.bin, though. Then, extract 'user data' to an *.ISO file, and use that.
If all you want to do is mount it, mounting utilities such as Virtual CloneDrive or other may do it as well. I'm less familiar with those.
the result of disktype command is
You cannot post new topics in this forum You cannot reply to topics in this forum You cannot edit your posts in this forum You cannot delete your posts in this forum You cannot vote in polls in this forum