A simple guide on how to mount NTFS/Windows Partitions from E01 images in Linux.

Mounting #

Create mountpoint for E01 image #

mkdir /mnt/ewf

Mount the E01 image and verify #

sudo ewfmount /path/to/your/Windows.E01 /mnt/ewf
sudo ls -la /mnt/ewf

sudo ls -la /mnt/ewf

Look at the partition table to identify the starting offset of the partition of interest #

sudo mmls /mnt/ewf/ewf1

In this example, our partition of interest is the one starting with 1126400.

Create a mount point for the NTFS Partition #

sudo mkdir /mnt/Windows

Mount the partition #

sudo mount -t ntfs-3g -o loop,ro,show_sys_files,stream_interface=windows,offset=$((1126400*512)) /mnt/ewf/ewf1 /mnt/Windows

Check that all is mounted correctly #

sudo ls -la /mnt/Windows

Unmounting #

Unmount the Windows mount point #

sudo umount /mnt/Windows

Unmount the E01 image #

sudo umount /mnt/ewf