cgsecurity.org

Hello guys,

I'm new of this forum. I apologize in advance with you for my basic questions.

I have 42 EWF image files (.E01, ...,.E42).
I only need to extract user data (at this moment I've no need to carving deleted/corrupted files).

Please, can you tell me if the command: testdisk 'imagefile.???' allows me to visualize the directories Documents, Picture, Music, ... and download the files that are there ?

Thanks a lot.

Yes, you can use testdisk to list the content of the ewf files: advanced, select the partition, List...
Under Linux, you can also use ewfmount (package ewftools)