Home > Belkasoft Evidence Center > Belkasoft Evidence Center Help Contents

Mounting images

< Previous help topic Next help topic >

The product supports for mounting drive images in the following format:

  • Encase evidence files (with extensions like e01)
  • DD raw images
  • SMART images

Multi-part images are supported, when the number of files does not exceed 99.

If a product fails to search through an image file, the drive might have uncommon sector size. To support drives with uncommon geometry, there is a parameter Sector size in bytes available in the Search histories wizard. In case of an Encase image, this information can be automatically obtained by tool from the metadata. If the Auto determine check box is checked for RAW image, the sector size will be assigned to 512 bytes. In other cases you should specify this parameter manually.

You can get this information from acquiring image log. For example, FTK Imager creates a log file with the following information:

Physical Evidentiary Item (Source) Information:
[Drive Geometry]
Bytes per Sector: 512
Sector Count: 248 608
Source data size: 121 MB
Sector count: 248608
[Computed Hashes]
MD5 checksum: 846ec9fc35db64377f2ebdaa46f0459f
SHA1 checksum: b9ba2b6d80019b44c6d7accdd17b67d9bfd4a546

Bytes per Sector from this log is the desired parameter.

< Previous help topic Next help topic >