Excuse my bad english......
I have made EWF Images (E01) from an external hard drive. I'm supposed to determine which changes to the timestamps of the files resulting from different operating systems at the opening, copying, reproduction, etc..
Therefore, I want to restore the EWF Image whenever you need them on the external drive.
I am aware that you can write back e01 Images to a hard disk with X-ways Forensics. However, the timestamp of some files are changed, so that the hash value is no longer correct under windows after completing the back rubbing. Currently I have the E01-Image converted to a dd-image and write it back with Linux to the external disk.
Is there a way in Linux, the E01-file write back directly to the disk ?
Thank you
Kurt W.
↧