My ultimate goal is to run the image in Vmware, but the bad partition table keeps me from doing that.Starting with Windows Insiders preview build 20211, WSL 2 will be offering a new feature: wsl -mount. I've tried FTK imager command line for linux, but it is not helpful since it doesn't have the option of mounting an image like it's counter part in windows.

In some cases useful info is found in syslog - tryĪfter all of the above, I did manage to produce (in windows) a full logs file with log2timeline.py from that image.įTK imager (in windows) managed to mount the image and show me the folders tree and file, but because it is windows i cant export the files or read them. Missing codepage or helper program, or other error 'wrong fs type, bad option, bad superblock on /dev/loop0, I then use 'mount as follows mount /media/singleFileDir/ewf1 /media/MountFolderOfFile/ my syntax is as followsĮwfmount /media/myfirste01file.e01 /media/singleFileDir –> get me a single file name 'ewf1' 'Macintosh HFS Extended version 4 data (mounted) last mounted by 'HFSJ', created Mon Jun 17 093315 2148, last modified Tue Nov 19 023243 2148, block size 4096, number of blocks 121839616, free blocks 53334222' While running 'file' on the image file it outputs Invalid magic value (Mac partition table entry (Sector 1) ffff)

While running on the E01 file itself - mmls -i ewf -t mac it outputs

I have tried using tools such as ewfmount, mount_ewf.py, xmount which generated a single file that i should be able to mount with 'mount' and yet i am getting an error that says the partition table is not valid. i currently use the SIFT 3 dist but i use kali also. I got a Mac image in a form of E01 files, which i fail mount in linux.

Mount mac on linux