Format Conversion

September 5th, 2010 Leave a comment Go to comments

This page provides information on converting from one format to another.

Disk Images

Disk images may be distributed in Raw (dd), EnCase/Expert Witness (E01), or Advanced Forensics Format (AFF) formats.

To convert from EnCase to Raw format, use the ewfexport command (part of the libewf package):

$ ewfexport filename.E01

If filename is a multi-volume EnCase file, you may need to specify all of the files on the command line, e.g.:

$ ewfexport filename.E??

On windows, you may need to specify all of the file names:

$ ewfexport filename.E01 filename.E02 filename.E03

To convert an AFF file to Raw format, use the afconvert command (part of the AFFLIB library):

$ afconvert -e raw filename.aff

  1. No comments yet.

 

"This material is based upon work supported by the National Science Foundation under Grant No. 0919593. Any opinions, findings, and conclusions or recommendations expressed in this material are those of the author(s) and do not necessarily reflect the views of the National Science Foundation."