Skip to end of metadata
Go to start of metadata

You are viewing an old version of this page. View the current version.

Compare with Current View Page History

« Previous Version 9 Next »

Forensic Image File Formats

HstEx® v4 natively supports a number of different image and output file formats. The following table represents a summary of the supported file types.


File FormatFile Extensions
EnCase®  v1-7 Image File (EVF / Expert Witness Format)*.e01
EnCase® v7 Evidence File Format Version 2*.ex01
SMART/Expert Witness Image File*.s01
X-Ways Forensics Image File*.e01
VMWare Virtual Disk File*.vmdk
Virtual Hard Disk*.vhd
Segmented Image Unix / Linux DD / Raw Image Files*.000, *.0000, *.00000, *.001, *.0001, *.00001
Single Image Unix / Linux DD / Raw / Monolithic Image Files*.dd; *.img; *.ima; *.raw
Memory Dumps*.dmp; *.dump; *.crash; *.mem; *.vmem; *.mdmp
Binary Dumps*.bin; *.dat; *.unallocated; *.rec; *.data; *.binary
Mobile Phone Raw Binary Memory Dumps*.xry


We have removed support for the Advanced Forensics Format (AFF) in HstEx® v4.


Direct Sector Access to Physical and Logical Devices

HstEx® has the ability of directly accessing at the sector level any physical or logical devices attached to the host system. This allows the user to employ hardware / software write blockers and to recover data directly from a disk or external media.



A write blocker should be used when accessing physical or logical devices directly. If the hard disk is failing, please use a data recovery imager to capture the data from the device first and run HstEx® against the resulting image.

  • No labels