Blade supports a number of forensic image and output file formats. The following table presents a summary of the supported file types. |
Supported Forensic Image Formats | |
EnCase® v1 - 8 Image File (EVF / Expert Witness Format) | *.e01 |
EnCase® v7 - 8 Image File (ex01) | *.ex01 |
AccessData® FTK Image Files | *.e01, *.001, *.s01 |
Advanced Forensic Format (AFF®) | *.aff;*.afd,*.afm |
Logicube Forensic Dossier® E01 | *.e01 |
SMART/Expert Witness Image File | *.s01 |
X-Ways Forensics Image File | *.e01 |
VMWare Virtual Disk File | *.vmdk |
Virtual Hard Disk File | *.vhd |
Segmented Image Unix / Linux DD / Raw Image Files | *.000, *.001 |
Single Image Unix / Linux DD/Raw Image Files | *.dd; *.img; *.ima; *.raw |
Memory Dumps | *.dmp; *.dump; *.crash; *.mem; *.vmem; *.mdmp |
Binary Dumps | *.bin; *.dat; *.unallocated; *.rec; *.data; *.binary |
Micro Systemation Extraction File | *.xry |
Table 1
Blade can search any binary file for supported recovery profiles and also supports direct sector level access to Physical and Logical devices. This allows the user to employ hardware / software write blockers and to recover data directly from a disk or external media.