Feature request: Parsing of x-ways created .e01

Tool requests, development, and troubleshooting topics related to TSK.

Moderator: carrier

Feature request: Parsing of x-ways created .e01

Postby bohdi » Wed Nov 23, 2016 10:15 am


When working with x-ways - files can be put into a .ctr and then this can be exported to an .e01

But this x-ways created .e01 contains a special file system: XWFS2 - and this cannot be interpreted by sleuthkit/autopsy.

See this link for more information: https://x-ways.net/investigator/evidenc ... ainer.html

It would be great if sleutkit/autopsy could import and support such .e01s. One of the reasons for wanting this is that my unit uses Griffeye Analyze DI, and this tool uses functionality in sleuthkit to read evidence files.

EnCase7/8 has support for reading the content in these .e01 files- but no such luck in Autopsy (sleuthkit).
Is this a feature that Autopsy (sleuthkit) can implement?

/merged from a double post by OliverH
Posts: 1
Joined: Tue Nov 15, 2016 9:58 pm

Re: Feature request: Parsing of x-ways created .e01

Postby rcainrc » Wed Oct 11, 2017 3:17 pm

I would like to add a +1 for the support for the X-ways XWFS2 file system format to be included in Sleuthkit/autopsy.
Posts: 1
Joined: Wed Oct 11, 2017 3:14 pm

Return to The Sleuth Kit (TSK)

Who is online

Users browsing this forum: No registered users and 0 guests