Format Conversion

September 5th, 2010 Leave a comment Go to comments

This page provides information on converting from one format to another.

Disk Images

Disk images may be distributed in Raw (dd), EnCase/Expert Witness (E01), or Advanced Forensics Format (AFF) formats.

To convert from EnCase to Raw format, use the ewfexport command (part of the libewf package):

$ ewfexport filename.E01

If filename is a multi-volume EnCase file, you may need to specify all of the files on the command line, e.g.:

$ ewfexport filename.E??

On windows, you may need to specify all of the file names:

$ ewfexport filename.E01 filename.E02 filename.E03

To convert an AFF file to Raw format, use the afconvert command (part of the AFFLIB library):

$ afconvert -e raw filename.aff

  1. No comments yet.