Mount Encase File with multiple partitions

[axeskidz]

Hi team! i'm trying around but without luck.
story is; i have made an *.E01 image with guymager on linux. this image contains 2 partitions, i mean; its a whole disk image.
when i open it with osf mont, it gives me a letter (H but with no content. So; whats the matter?
i'm not using it well?

thanks in advance!

[David (PassMark)]

What file system is in each partition?
Maybe it is a Linux EXT3 file system. And of course Windows doesn't understand the Linux file system, and will display nothing as a result.

You should be able to use OSForensics to view the content however (without mounting it with a drive letter).

[lauzona]

Hi
for that scenario (a encase Disk with Linux Filesystem) i have a working solution.
You need Paragon Extfs for Windows after installing you can mount the hole Encase Disk with ftk imager
now you can use the Disk in OSForensics but not as Image of a Disk you use real Disks than but writhe protected from ftk.

maybe that Tip is a little bit late but for next one you can use it

A other real cool way is Docan Filesystem it is compatible with Fuse and can run many Filesystems native in windows that windows
normale not know

try it is open source:

https://dokan-dev.github.io

best

Andre

[David (PassMark)]

OSF can directly access an EnCase image of a Linux file system.
If you are doing forensics, then you should need write access to the disk, so probably don't need any external 3rd party tools.