Supported Image File Formats
Blade supports a number of forensic image and output file formats. The following table presents a summary of the supported file types.
Supported Forensic Image Formats | |
EnCase® v1 - 8 Image File (EVF / Expert Witness Format) | *.e01 |
| EnCase® v7 - 8 Image File (ex01) | *.ex01 |
AccessData® FTK Image Files | *.e01, *.001, *.s01 |
Advanced Forensic Format (AFF®) | *.aff;*.afd,*.afm |
| Logicube Forensic Dossier® E01 | *.e01 |
SMART/Expert Witness Image File | *.s01 |
X-Ways Forensics Image File | *.e01 |
VMWare Virtual Disk File | *.vmdk |
Virtual Hard Disk File | *.vhd |
Segmented Image Unix / Linux DD / Raw Image Files | *.000, *.001 |
Single Image Unix / Linux DD/Raw Image Files | *.dd; *.img; *.ima; *.raw |
Memory Dumps | *.dmp; *.dump; *.crash; *.mem; *.vmem; *.mdmp |
Binary Dumps | *.bin; *.dat; *.unallocated; *.rec; *.data; *.binary |
Micro Systemation Extraction File | *.xry |
Table 1
Sector Level Access to Physical / Logical Devices
Blade can search any binary file for supported recovery profiles and also supports direct sector level access to Physical and Logical devices. This allows the user to employ hardware / software write blockers and to recover data directly from a disk or external media.