Overview

From time to time, it may be necessary to convert an EnCase (or other Expert Witness image) back to a standard non-proprietary format.  This Professional Recovery Module is FREE with the purchase of any other professional module.  The E01 Image Converter will take any Expert Witness source image and convert it into a single or segmented flat file image.  The module also has the option to MD5/SHA1 the output and compare it with the hashes embedded within the original image file.

Recovery Module Properties

To set or review the conversion options, right click on the Recovery Profile and select Module Properties.  The following dialogue box will appear giving access to the various options for this module.

 

Figure 1

 

The resulting image file can be a single or segmented.  There are options to change the extension and to set the size of the segment file.  You can also select whether the output is validated against a SHA1 or MD5 hash.  This will check the output data against the embedded hash information inside the image.  Converting an image is something an examiner may do on a regular basis, especially if he/she wishes to mount the image as a physical device or volume.  This allows the examiner to analyse a forensic image using tools that do not natively support the Expert Witness fileformat.  The following video demonstrates setting the module properties to select whether the image is segmented or single file and how to set the segment size: