Mounting & Unmounting E01 in SIFT

To mount E01 in SIFT

1. cd to the folder with the E01
2. ewfmount /mnt/ewf_mount
3. cd /mnt/ewf_mount
4. ls to make sure it’s there
5. mount -o ro,loop,show_sys_files,streams_interface=windows ewf1 /mnt/windows_mount/
6. cd /mnt/windows_mount

To unmount E01 in SIFT

1. umount /mnt/windows_mount
2. umount /mnt/ewf_mount