Convert E01 to A00

Understanding E01 and A00 file formats

E01 files are forensic disk image files created by EnCase, a popular digital forensics tool. These files store exact copies of data from storage devices, including metadata and checksums for integrity verification. A00 files, on the other hand, are segment files associated with the AccessData FTK Imager tool. When FTK Imager creates a segmented image, the first segment is usually an E01 file, and subsequent segments are named A01, A02, ... or A00, A01, ... depending on the tool's version and settings.

Why convert E01 to A00?

Conversion from E01 to A00 is typically required when you need to use disk images across different forensic tools or when a segmented image format is necessary for compatibility or storage reasons. Some forensic suites prefer or require the segmented format for processing large images.

How to convert E01 to A00

Direct conversion from E01 to A00 is not a standard process, as A00 files are not a standalone format but part of a segmented image set. The typical workflow involves re-imaging or re-segmenting the E01 file using a forensic imaging tool that supports both formats.

Recommended software for conversion

• AccessData FTK Imager: This is the most reliable tool for converting or re-imaging E01 files into segmented image sets with A00, A01, etc. segments.
• X-Ways Forensics: Also supports re-imaging and segmenting E01 files into other formats.

Step-by-step conversion using FTK Imager

1. Open FTK Imager.
2. Go to File → Add Evidence Item and select your E01 file.
3. Once loaded, right-click the evidence and choose Export Disk Image.
4. Choose Raw (dd) or Custom as the image type, then set the segment size as desired.
5. FTK Imager will create a segmented image set, starting with A00 (or A01, depending on settings).

Important considerations

• Always verify the integrity of the converted image using hash values.
• Be aware that some tools may use A01 as the first segment instead of A00.
• Keep original E01 files as backups in case re-imaging is needed.