E01 Forensics – Examining Structure and Storage E01 Image File Format

Creative Team | April 1st, 2020 | Forensics

E01 forensics file type is a forensic disk image file format that are legally denoted as the Expert Witness Format. The file was introduced by EnCase from Guidance Software and was later adopted by several other disk imaging applications like FTK Imager. The purpose was to serve imaging ceased data from a machine/hard drive/external storage media, etc. Moreover, it is one of the  important stages during the digital forensics process.

Forensic imaging is considered to be the most crucial stage of the digital forensics process. According to the norms of digital forensics, processing to acquire evidence in its original form is not considered to be right from a legal standpoint. It may have a high chance of resulting in the spoliation of evidence. Investigation process always have a possibility of leaving their traces behind on litigated data, no matter how carefully the process executed. Therefore, cloning or imaging of the evidence is  of utmost importance towards maintaining the integrity and true state of the evidence.

Encase Forensic Image File – Role of EnCase Disk Image

The Encase E01 file is a forensically used evidence file format for imaging purposes. The file tends to store a variety of evidentiary contents like; disk image, i.e., each bitstream of the ceased disk, existing memory, volume imaging, and logical files. Besides, the Guidance Software owned E01 image file format consists of checksum for each block and footer with MD5 value for the complete bitstream on the disk. The file format also permits for the compression there by cutting down the number of image files after acquisition and imaging.

An Overview – EnCase E01 Image File Forensics

Digital Forensics is a wide arena that consists of multiple branches such as data forensics, database forensics, email forensics, etc. However, it denotes the examination of entire data types that store information electronically. Therefore, EnCase 5 when launched proved not as efficient as a forensic imaging tool. Because it was not efficient of tackling email data that are a major challenge for forensics examiners owing to the fact.

With the launch of EnCase 6, the expectations for support towards the handling of emails grew higher but the hurdle had not been removed yet. The version of EnCase was still unable to tactfully deal with email messages, i.e. the support was provided but only for a limited number of (minor level of) emails. Therefore, many other applications including FTK Imager arrived to serve online the same imaging facilities and format (E01) but with enhanced capabilities. However, later EnCase came up with major advancements and has reached version 7.10 that even supports imaging tablets and smartphone storage.

Analysis of E01 Image Files with MailXaminer

MailXaminer is one of the best email forensics tool which is majorly used by the investigators for digital forensics investigation purposes. With the help of this software, user can directly process and analyze the email data along with attachments. It provides a facility to examine raw image format files including E01 into the software using its advance features. Users can use various inbuilt functionalities within the software panel for E01 forensics and find the evidence in a smart yet efficient way.

To analyze the E01 forensic imaging of email data, users can perform these steps using the proficient software MailXaminer:

  • First of all, click on “Add Evidence”. Then, a window will pop-up to “Add File“. Choose the “E01” file format to scan the evidence logical file into the software.

Add File

  • Now, click on “Browse” to browse the existing location of the file within the computer. Then, click on “Scan Setting”.

Browse files

  • Under “Setting” window, mark the check box corresponding to “Loose Files” in the “Index Setting” section and click on “Save”.

save Scan Setting

multiple options

Structure of E01 Image File Format:

  • Every E01 image file type structure begins with the Header portion containing Case Information.
  • A 64-sector block that sizes 32 KB acts as a separator between each data block. Additionally, it is interlocked with a Cyclic Redundancy Check.
  • Then the footer of the file containing the MD5 value of the data imaged within.

Structural Analysis of Disk Image File E01 Forensics

Despite all the applications that are providers of E01 files are serving the same structure for the file format. E01 file forensics brings out the output of E01 structural analysis that helps to understand the E01 disk image file format and platform for its examination purpose.

The E01 image files stores whatever is found on the disk (external, internal, or removable) whether in the form of data files, databases, or even system files. That is how an E01 file type stores data and this makes it unique in storage, structure, and accessibility too.

One of the major peculiarities about forensic E01 file is that it is only the file extension that changes and not the original file name. Moreover, every chunk can store only 640 MB of data, still, the file extension changes afterward while the structure remains in one piece (i.e., E01, E02, etc.).

Conclusion:

Here we cover all about how information is stored and arranged within an E01 Image File Format. The unique structure of an E01 file type makes it dependent on the origin platform, i.e. EnCase or FTK Imager on which the image has to be mounted to viewed and interpreted. Thus, E01 forensics is executable in a similar manner owing to its proprietary structure and formatting. To analyze and investigate the disk image file, use MailXaminer forensic tool. It has the capability to support documents of various nature including E01 image files.