Open EnCase/SMART Image


pbarbeau

New Member
Feb 26, 2019
1
Ratings
1
3
#1
I am having a hard time opening an EndCase Image (*.ex*) of a hard drive and was wondering if anyone can point me in the right direction to open these files. I have tried a number of my normal tools on windows or unix and have not had any luck. Any advice would be great.

Below is my try with ewfmount.

ewfmount 20140608

Unable to open EWF file(s).
libewf_glob: invalid filename - missing extension.
mount_handle_open_input: unable to resolve filename(s).

disktype 71414301.Ex01

--- 71414301.Ex01
Regular file, size 2.001 GiB (2148495952 bytes)
 

athulin

Member
Experienced Member
Oct 18, 2007
734
Ratings
11
18
#2
You don't say how you invoked ewfmount: what command line did you use?
Guess: You do seem to have the error right there: 'missing extension'. So probably you left the '.ex01' part out.

Is 'disktype 71414301.Ex01' your command line? If so, the documentation of disktype should tell you if ex01 is a supported format or not. (Doesn't look like it based on current content of disktype - disk format detection. Disktype is best for real on-disk data structures, not for archive or image formats like .eXX or .exXX ). file(1) is often better for those.
 

About us

  • Our community began in 2004. Since this time, we have grown to have over 29,000+ members within the DFIR & Cyber Security community.

    We are happy to announce that this forum is now under new ownership with the goal to once again become the main Digital Forensics Forum on the internet for DFIR, OSINT and Cyber Security.

    If you can think of ways to help us improve, please let us know.

    We pride ourselves on offering unbiased, critical discussion among people of all different backgrounds.

    We are working every day to make sure our community is one of the best.

Quick Navigation

User Menu