Question
Can Intella index forensic disk images, such as EnCase E01 files?
Answer
Yes, Intella can index the following disk image types:
- EnCase images (E01, Ex01, L01, Lx01 and S01 files)
- FTK images (AD1 files), version 3 and 4
-
AFF4 images:
AFF4 physical images containing images of the Contiguous Image or Diskimage AFF4 lexicon type.
-
AFF4 logical images:
Pre-release 1.0 version.
Version 1.1. Supporting all AFF4 lexicon types described in "AFF4-L: A Scalable Open Logical Evidence Container".
Version 1.2. Supporting password-based encryption.
-
-
DMG. Supported compression formats: ADC, LZFSE, ZLIB, BZIP2. Supported compressed image formats: UDCO, UDZO, UDBZ, UDCo. Supported uncompressed image formats: RdWr, Rdxx, UDRO.
- DD images
- MacQuisition images (RAW, .00001 files)
- ISO images (ISO 9660 and UDF formats)
- VMware images (VMDK files). Supported types are RAW (flat), COWD version 1 (sparse) and VMDK version 1, 2 and 3 (sparse). Not supported are images that use a physical storage device
- Microsoft Virtual PC images (VHD) Supported type is VHD version 1
- BitLocker-encrypted volumes
- Volume shadow copies
- X-Ways image files (.CTR files)
Indexing disk images in Intella can be done in two ways:
- Using the "Disk Image" source type in the "Add new source" wizard. This is the recommended method, as it offers disk image-specific options like validation of the image, gathering all parts of a multi-volume disk image, and detecting image-level encryption.
- Using a "File or Folder" source to index the disk image. However, this method won't provide specific options for disk images, as mentioned above.
It's important to note that Intella can only index 'active' files. To index the unallocated space of disk images, users should carve their forensic image first, save the carved data to a folder or logical evidence container such as an L01 file, and then index that data along with the image using Intella.
Updated April 2023