Mounting E01 Forensic Images in Linux
So you want to mount an E01 forensic image? This guide will help.
If you have an Encase Expert Witness Format E01 image, and you’d like to mount it for examination, there is a free library for Linux that will assist.
E01 images are compressed, forensically sound containers for disk images acquired during an investigation. To work with them, we must utilize a tool that will stream decompress the image so that we can mount and work with the contents.
These tools and shortcuts are preinstalled on the Linux SIFT workstation.
ewf-toolslibrary (already included on Linux SIFT workstation)
sudo apt-get install ewf-tools
Examine the metadata associated with the E01 by running
Let’s create a mount point that we’ll use to mount the E01 as a raw device
mkdir -p /mnt/ewf_mount
Now, mount the E01 forensic image to a new raw device
ewfmount your_image.e01 /mnt/ewf_mount
A successful mount operation will provide a very minimal output such as “ewfmount 20140812”
You will now have a stream-decompressed raw device at
ls -alh /mnt/ewf_mount
Create a new mount point for the logical mount we’re about to perform, and then mount the device to the new logical mount point.
mkdir -p /mnt/logical_mount
mount -o ro,show_sys_files,streams_interface=windows /mnt/ewf_mount/ewf1 /mnt/logical_mount
Pro Tip: create a bash alias that simplifies this mount command for the future, allowing you to replace it with simply
mountwin— you must reload bash for it to take effect.
echo “alias mountwin='mount -o ro,show_sys_files,streams_interface=windows'“ » ~/.bash_aliases
Now, change directory into the logical mount point, and examine the file system!