With the second bug you listed, Imager has workflows for imaging an image. I have never had any issues with reliable reads with the new version in these use cases. I typically only use disk mounting to open files in native Windows apps (say photos, videos, etc), run virus scans, run python scripts over it (I don't have the time learn how to unpack a forensic image in python haha), or run CMD/PowerShell commands like VSC checking. Excess ~64MB over the original base image Re-image reported as containing 234572854 sectors (incorrect)Įrror reported: The following sector(s) on the source drive could not be read: 234572821Į.g. Re-image using FTK Imager v4.5.0.3: 'ImageOfImageOfImage.E01' Mount previous image 'ImageOfImage.E01' using FTK Imager v4.5.0.3 Excess ~32MB over the original base imageĤ. Re-image reported as containing 234507251 sectors (incorrect)Įrror reported: The following sector(s) on the source drive could not be read: 234507218Į.g. Re-image using FTK Imager v4.5.0.3: 'ImageOfImage.E01' Mount previous image 'BaseImage.E01' using FTK Imager v4.5.0.3 Image reported as containing 234441648 sectors (correct)ģ. Image using FTK Imager v4.5.0.3: 'BaseImage.E01' Wipe test disk and create a single NTFS partitionĢ. I have created test images to illustrate this problem. Practically, this means that images mounted using the most recent FTK ImagerĪccess Data acknowledged this problem in November 2020 and are currently investigating a fix. re-image) a virtual disk may fail with a sector unreadable error.

(The tool adds a fake EFI partition table and 32MB when it mounts an image) The virtual disk is thus not a faithful copy of the original image and has a different hash. When an E01 image is mounted, the resulting virtual disk is ~32MB bigger than the underlying image.There are two potentially serious bugs in the image mount feature of the most recent FTK Imager.

Download ftk imager