Closed pipizhao-2020 closed 3 years ago
The content of an E01 depends on what you put into it. If it is a hard disk you need to analyze it with tooling that understand partition tables, volume systems and files systems. If it is process memory, you need tooling that can help debug/analyze process memory.
is a hard disk,i want to analyze it by myself with c/c++.
Then you need to write the tooling to analyze it. Start doing research on different partition tables, volume system and files system format. Maybe there is existing tooling out there you can use. This is out of scope for this project, I'll consider this question answered and close this issue.
i want to analysis the file information that contains in the E01 file.