Evidence Image File SupportΒΆ

  1. raw (Single raw file (dd))
  2. aff (Advanced Forensic Format)
  3. afd (AFF Multiple File)
  4. afm (AFF with external metadata)
  5. afflib (All AFFLIB image formats (including beta ones))
  6. ewf (Expert Witness format (encase))
  7. split raw (Split raw files) via affuse
  1. affuse ‐ mount 001 image/split images to view single raw file and metadata
  1. split ewf (Split E01 files) via mount_ewf.py
  1. mount_ewf.py ‐ mount E01 image/split images to view single raw file and metadata
  2. ewfmount – mount E01 images/split images to view single rawfile and metadata