E01 File Extractor
Open an E01 file on Windows without EnCase. E01 file extractor loads the segment chain and exports what matters.
Version 26.7 · Windows 11, Windows 10, Windows 8.1, Windows 7 and Windows Server
Open an E01 file on Windows without EnCase. E01 file extractor loads the segment chain and exports what matters.
Version 26.7 · Windows 11, Windows 10, Windows 8.1, Windows 7 and Windows Server
Multiple E01 files usually mean one acquisition, not many, although every file looks complete on its own.
Inside the evidence file
What E01 extractor software opens, and what it pulls out of an evidence file, before anything reaches the desktop.
E01 file extractor opens Expert Witness Format version 1 and version 2 from one window, plus the older SMART .s01 container, with no setting to select. EnCase moved to that second format generation at version 7, so both sit in one list here.
Point the tool at whichever folder holds the set and segments are joined back into one image before anything else happens. One acquisition runs across numbered segments, .E01 through .E99 and then .EAA onward.
An E01 image opens on an ordinary Windows desktop, with nothing from EnCase present on that machine. It matters when the licence has lapsed or the examiner who held it has left.
Every 32 KiB chunk is checked against its Adler-32 value while an E01 image loads, so a damaged segment is reported rather than hidden. Acquisition MD5, and SHA1 when the imaging tool stored one, are lifted from that image and shown on screen.
E01 extractor parses the MBR or GPT partition table first, then NTFS, FAT, exFAT, ext and HFS Plus volumes on it, so an evidence file opens as a folder tree. An E01 holds an entire hard disk, not a list of files, layering that also sits inside a virtual hard disk.
Search the tree or browse it, then tick one document and export it on its own. Retrieving one spreadsheet from a 500 GB E01 image does not mean writing 500 GB back out first.
An E01 image opens on its own, with EnCase nowhere in sight.
Run the Free DemoFive steps from a segment chain on a drive to the documents that matter.
Use Open File and point it at the first segment of a set. When the acquisition is split across several segments, use Open Folder and point it at whichever directory holds them all.
Identification runs on the signature at the head of the file, EVF for version 1 and EVF2 for version 2, so a renamed evidence file still opens. File Details names the container and reports the acquisition metadata stored in its header, before anything is committed.
Partition tables come first, whether MBR or GPT, then the filesystem on every partition, so the result is a folder tree rather than a single opaque blob. All NTFS, FAT, exFAT, ext and HFS Plus volumes inside the E01 image open as folder trees.
Use the search option on a file name or walk the tree, then tick an entire partition, one folder or a single document. An E01 acquisition is usually far larger than the handful of files anyone actually wants back.
Files leave the image with their original directory structure and both timestamps, created date and modified date. The tool opens the segment chain read only and never writes to it.
Only the size of ticked files, not of the entire acquisition. That is the practical difference between extraction and restoring an image to a disk, the same reason people restore individual files from an image backup instead of the entire set. It matters most when the evidence set is bigger than the free space available.
Not an archive of files. An image of an entire disk, plus the record of how it was taken.
Expert Witness Format, version 1
A sector by sector image of a disk, compressed with deflate and split into 32 KiB chunks. A header block stores acquisition date, examiner name and notes typed at acquisition time. Inside sits a partition table, then filesystems, then documents. Nothing in Windows unwraps that outer layer.
EnCase 7 and later
EnCase 7 introduced a second format generation. Ex01 adds bzip2 compression beside deflate and an option to encrypt the image with AES-256. An unencrypted Ex01 opens here like an ordinary E01. An encrypted one stays locked until the key is supplied to the product that wrote it.
One acquisition, numbered files
Imaging tools split one acquisition into fixed size segments so it fits on removable media. The extensions run .E01 through .E99, then .EAA through .EZZ. That is one image in pieces, not several images. Load the folder and the pieces are joined back up.
Yes. An E01 extractor opens one on Windows. The common belief is that opening one needs EnCase itself, or at least a forensic suite.
That was true once. EnCase files use Expert Witness Format, and that format has since been documented in public through the libewf project, so the layout is parsable by tools that never came from Guidance Software. The container is closed, not encrypted. The two are not the same thing. Once the layout is parsed, the disk image inside behaves like any other disk image.
What is not required
An EnCase licence, current or expired
A forensic suite installed on the machine opening the E01 file
A Linux box and a two step command line mount
The imaging hardware or the drive that was acquired
Five routes open an EnCase E01 file, and two of them cost nothing. Every route depends on something that may be missing, so the right one varies.
When a licensed EnCase or X-Ways install is still on the machine, start there. Everything below this line covers the case where that route has closed, which is the usual reason anyone lands on this page.
| Route | Opens E01 |
Opens Ex01 |
What it gives | The catch |
|---|---|---|---|---|
| EnCase Paid |
Wrote the format, so it opens any container it made, including encrypted Ex01 when the key is available | Examiner seat priced for a forensic lab. Nothing here helps once the licence has lapsed or the examiner who held it has left | ||
| FTK Imager Free |
Add Evidence Item, choose Image File, browse the tree and export selected files. Free, and capable on Windows | An acquisition tool built for examiners, so its workflow assumes an examiner's habits. Downloads sit behind a vendor account, and encrypted containers are out of scope | ||
| Arsenal Image Mounter Free tier |
Mounts an evidence file as a real Windows disk, so Explorer browses it like any other drive | Windows has to understand the filesystem inside. An ext4 or HFS Plus volume mounts as an unreadable disk, and the paid edition is where the rest of the feature set sits | ||
| libewf and ewfmount Free |
Open source library that documented the format. ewfmount exposes the segment chain in one raw image, which is then mounted | Linux and the command line, in two stages. Mount the image, work out the partition offset, then mount that. No help at all on a Windows desktop | ||
| Windows or 7-Zip Built in |
Nothing. Windows has no reader for Expert Witness Format and a general archive tool cannot parse the container | Double-clicking an .E01 produces an Open With prompt and nothing else |
FTK Imager and libewf both do the job, and neither is aimed at someone who needs four documents back from an old acquisition. One asks for a forensic acquisition workflow, the other for Linux and two mount commands. E01 extractor software is the Windows middle ground, a file browser over that image, exporting what is ticked.
E01 file extractor at a glance
An imaging tool splits one E01 acquisition into fixed size segments, so a folder of .E01, .E02 and .E03 files is one disk image in pieces. Only the first segment carries a header.
One segment on its own
Hand the tool a lone .E02 and there is no header, no partition table and no starting point, so nothing opens. A missing segment in the middle cuts the image short at that point. Copy all E01 segments off that drive, not whichever file is named first.
All segments in one folder
Put all segments in one folder, keep their original file names and use Open Folder. The segments are joined back into one image, the disk inside is parsed once and the folder tree matches that disk as it stood at acquisition.
E01, Ex01 and S01 are Forensic edition formats, beside the other evidence containers.
E01 extractor tool ships in Forensic at $199 as a one time purchase, covering up to 10 machines and carries a perpetual licence with twelve months of updates and support. It holds everything in Professional and adds EnCase logical evidence files, FTK Imager AD1, AFF and AFF4 containers, LiME and AVML memory captures, plus deleted file recovery for FAT and NTFS with a recoverability rating on every result.
Expert Witness Format became the default way to hand digital evidence to someone else, so multiple E01 files on a drive rarely came from EnCase itself.
Expert Witness Format started at Guidance Software with EnCase and is now owned by OpenText. A set of E01 files with no obvious source usually traces back to one of the tools below. The case closed, the contract ended or the consultant moved on, although the acquisition stayed on the drive.
The product that defined the format, from Guidance Software and now OpenText. Produces E01 up to version 6 and Ex01 from version 7.
Free, widely used and the most common source of an E01 outside a forensic lab. IT teams reach for it to take a disk image before a rebuild.
Standalone duplicators and write blockers put E01 straight on the destination drive, which is why the set often arrives with no software attached to it.
ewfacquire from the libewf project produces the same format from a Linux host, often as part of an incident response kit rather than a case.
Questions that come up once the evidence file will not open
No. Expert Witness Format is a closed format, and it is not encrypted by default, so its layout is documented and parsable without the vendor tool. Dedicated E01 extractor software opens your segment chain, detects the partitions inside it and parses the filesystems on them, which is what turns an evidence file into a browsable folder tree. EnCase itself does not need to be installed or licensed.
E01 is version 1 of the format, produced by EnCase up to version 6 and by most other imaging tools. Ex01 is version 2, introduced with EnCase 7. Version 2 adds bzip2 compression beside deflate and an option to encrypt the image with AES-256. An unencrypted Ex01 opens like any E01 image. The difference only bites when your E01 image file was encrypted at acquisition time.
Not on their own. Opening one needs the first segment, because the header, the acquisition metadata and the start of the disk all sit there, so a set without its .E01 has no starting point. Go back to whichever drive your set came from and copy all E01 segments across, keeping the original file names. A gap in the middle of the chain cuts the image short at that point rather than stopping it opening at all.
An .s01 is a SMART evidence file, written by the SMART forensic tool on Linux. It shares the segment and chunk design that Expert Witness Format uses, so one E01 viewer handles both. Seeing .s01 beside .e01 in a format list is not a mistake. It means the E01 viewer you are looking at covers both branches of the family.
Expert Witness Format stores an Adler-32 checksum on every 32 KiB chunk of data, so damage inside a segment is detectable rather than silent. Adler-32 checksums are validated while an E01 image loads, and a chunk that fails is reported. The acquisition hash held in the image, an MD5 and a SHA1 when the imaging tool stored one, is lifted out of the container and shown with the rest of the header detail.
Yes, when the imaging tool filled those fields in. An evidence file header carries date and time of acquisition, examiner name and notes typed at the time. File Details lifts them straight out of the container and puts them on screen, which is often enough to work out which machine your unlabelled E01 files came from. Those fields are also the first thing anti forensics techniques try to strip.
An encrypted Ex01 is flagged encrypted when it loads, and the contents stay locked. Expert Witness Format version 2 can protect an image with AES-256, and that protection works. If you hold the key, decrypt it with whichever product wrote it and open the result here. Backup Extractor is a reader, not a password recovery tool.
No. The evidence file stays strictly read only, so nothing is written back into it at any point. All processing happens on your own computer with nothing sent anywhere, so that set of segments opens again later and behaves identically.
An E01 extractor opens the segment chain, runs the same validation pass the paid build uses and lists all files and folders inside the image. Writing the files out is the part that needs a licence. That is enough to prove your own E01 image file is readable before you spend anything, which is the sensible order to do this in.
Yes. Matching runs on the signature bytes at the head of the file rather than the name, so a renamed or extensionless evidence file loads the same way. A renamed segment set is different, because the segments are matched to one another by their numbering. Keep the original names within the set.
Forensic at $199. Standard covers archive formats and Professional covers backup software and virtual disks, so neither one opens an E01 file. Forensic is the edition that opens E01, Ex01, S01, the logical evidence files and the AD1, AFF and AFF4 containers.
E01 File Extractor
E01 extractor loads the segment chain, shows what it holds and exports only the documents needed.
Free Demo Download Purchase Now
Version 26.7 · Windows 11, Windows 10, Windows 8.1, Windows 7 and Windows Server · 30 day money back
BitRecover has been building data recovery and format conversion tools since 2011. The EnCase support described on this page reflects the current Backup Extractor release.
The full tool, 34 format families across backup archives, tape, virtual disks and forensic containers like E01
For an Acronis disk image on the same drive, with no True Image left to open it
For a Veeam repository left behind, with no server left to restore it from