Frequently Asked Question
Issues with mounting Expert Witness Files (.E01, .Ex01, SMART)
Last Updated 3 years ago
It is highly recommended to use Apple native disk images when processing using macOS-based forensic tools such as RECON (.dmg, .sparseimage).
Non-native forensic image formats require the use of a translator such as FUSE for macOS and should be avoided if possible.
When attempting to mount any non-native Apple disk image please check the following each and every case when using RECON.
1.) Make sure that you have the most current version of FUSE for macOS installed - https://osxfuse.github.io. When installing, please be sure to give permissions to the macOS if requested (System Preferences - Security & Privacy - General). If you do not give permissions then you will not be able to mount EWF formats.
2.) Check to make sure that FUSE for macOS installed properly. Even it it says successful check to see if the libraries exist in /usr/local/lib by running the following commands with in the Terminal:
If you do not see these libraries then remove FUSE and reinstall from System Preferences.
3.) Check to make sure Full Disk Access is provided to RECON (System Preferences - Security & Privacy - Privacy). For unknown reasons, the macOS has been unchecking applications that were previously checked by the user. It is good practice to quickly check that Full Disk Permissions are provided each and every time before a case.
Non-native forensic image formats require the use of a translator such as FUSE for macOS and should be avoided if possible.
When attempting to mount any non-native Apple disk image please check the following each and every case when using RECON.
1.) Make sure that you have the most current version of FUSE for macOS installed - https://osxfuse.github.io. When installing, please be sure to give permissions to the macOS if requested (System Preferences - Security & Privacy - General). If you do not give permissions then you will not be able to mount EWF formats.
2.) Check to make sure that FUSE for macOS installed properly. Even it it says successful check to see if the libraries exist in /usr/local/lib by running the following commands with in the Terminal:
If you do not see these libraries then remove FUSE and reinstall from System Preferences.
3.) Check to make sure Full Disk Access is provided to RECON (System Preferences - Security & Privacy - Privacy). For unknown reasons, the macOS has been unchecking applications that were previously checked by the user. It is good practice to quickly check that Full Disk Permissions are provided each and every time before a case.