Working with split images

[Heinz Werner Kramski-Grote]

By default, Guymager splits images into 2 GB slices when using the recommended .Exx format.

Do the later "Forensic Tools" like Bulk Extractor or the reporting tools automatically take care of all slices, even if I only speciffy the first one (.E01)?

TIA
   Heinz

[pwolsen]

Hi Heinz,

Yes, bulk_extractor, fiwalk, and the BitCurator reporting and file access tools will reconstruct the full disk image from the .E01 file. Any tool capable of reading Expert Witness disk image formats (aka, E01) will look for the .E01 file and then, if necessary, reconstruct the full disk image from the additional image files automatically. The only restriction is that the other files in the disk image need to be in the same directory as the .E01 file.

However, unless you have a need to split the files, I recommend setting the point at which Guymager splits the image to petabytes (change the pull down option from MiB to PiB) so that your disk image is just a single file. 

Porter