No announcement yet.

OSFMount and very large E01 images?

  • Filter
  • Time
  • Show
Clear All
new posts

  • OSFMount and very large E01 images?

    Hi. I discovered OSFMount today, and I'm quite pleased. It seems to work great, as I've had some issues mounting E01 images using FTK Imager.

    I have an E01 image of a 6 TB drive, and when I mount it - it appears as a 5.5 TB device, but R-Studio (recovery tool) detects it as a 1.46 TB device.
    When I read beyond the 1.46 TB point, it fails reading.

    Does OSFMount have a limit to its sizes?


  • #2
    No limit that we are aware of (except the file system limits, which for example, for FAT32 is 2TB).

    Can other tools like OSForensics use the image?
    If using OSForensics, you don't need to mount the E01 to a drive letter, you can just read the E01 file directly and remove a layer translation code.

    How big is the E01 file itself?


    • #3
      The E01 is a 5.240.676.355.521 byte file, or 5.24 TB / 4.76 TiB.
      When opened in OSFMount (which also takes a while - but FTK does this too, so that's probably just E01 for me)..

      In picture 1, we can see it detects partitions, one of which is 5.45 TB. The disk i GPT partitioned. In step 4, I choose defaults, and then I mount it.

      In picture 2, it's been mounted and browsed in R-Studio. R-Studio indicates its size (top right) as 1.46 TB. It does however, see a partition sized 5.45 TB - but when I browse this partition in R-Studios hex editor, and move towards the end, I get the error output shown below the listing. It basically reports back "Parameter is incorrect" for each sector being read.

      I'm not sure if OSForensics can open it, as I've never used that tool before ..

      FTK Imager, however, can. It can open it, and mount it (I was able to browse the partition after I wrote the first post). It successfully lets me browse the end of the image.

      OSFMount also successfully shows the first part of the disk. According to R-Studio, it's reported as 1.46 TB, or Sectors. If I browse to that offset, I begin getting errors. Until then, it seems to work fine. When mounted with FTK, it is 11.721.045.168 Sectors long instead.


      • #4
        If the error just appears with R-Studio we aren't in a position to debug it.
        If possible can you test with OSForensics to see if you can read to the end of the E01 image (or really any other tool to start with to narrow down the problem).