Format Conversion

This page provides information on converting from one format to another.

Disk Images

Disk images may be distributed in Raw (dd), EnCase/Expert Witness (E01), or Advanced Forensics Format (AFF) formats.

To convert from EnCase to Raw format, use the ewfexport command (part of the libewf package):

$ ewfexport filename.E01

If filename is a multi-volume EnCase file, you may need to specify all of the files on the command line, e.g.:

$ ewfexport filename.E??

On windows, you may need to specify all of the file names:

$ ewfexport filename.E01 filename.E02 filename.E03

To convert an AFF file to Raw format, use the afconvert command (part of the AFFLIB library):

$ afconvert -e raw filename.aff

Leave a Reply

Your email address will not be published.

You may use these HTML tags and attributes: <a href="" title=""> <abbr title=""> <acronym title=""> <b> <blockquote cite=""> <cite> <code> <del datetime=""> <em> <i> <q cite=""> <s> <strike> <strong>

This site uses Akismet to reduce spam. Learn how your comment data is processed.