[How-To] Forensic Disk Acquisition using EWFAcquire CLI
Channel: DFIRScience
Date: 2017-11-07

Learn how to do a forensic disk acquisition in Linux command line using the tool EWFAcquire. EWFAcquire creates disk images in the Expert Witness Format (.E01). EWF images are a common file type used by Law Enforcement around the world. EWF has some additional features, such as compression and error checking, that you will not have with RAW (dd) disk images.

https://github.com/libyal/libewf/blob/master/documentation/Expert%20Witness%20Compression%20Format%20(EWF).asciidoc

🚀 Full Digital Forensic Courses → https://learn.dfir.science

010001000100011001010011011000110110100101100101011011100110001101100101 
Get more Digital Forensic Science
  👍 Subscribe → https://bit.ly/2Ij9Ojc
  ❤️ YT Member → https://bit.ly/DFIRSciMember
  ❤️ Patreon → https://www.patreon.com/dfirscience

🕸️ Blog → https://DFIR.Science
🤖 Code  → https://github.com/DFIRScience
🐦 Follow → https://www.twitter.com/DFIRScience
📰 DFIR Newsletter → https://bit.ly/DFIRNews
010100110111010101100010011100110110001101110010011010010110001001100101

Creative Commons Attribution-NonCommercial-ShareAlike 4.0 International License. Please link back to the original video. If you want to use this video for commercial purposes, please contact us first. We would love to see what you are doing.