unable to read a forensic .E01 image with pytsk3.FS_Info(image)

Question

I am Python beginner, and I want to read an .E01 image file with pytsk3. pytsk3.FS_Info(image) creates this error:

OSError: FS_Info_Con: (tsk3.cpp:214) Unable to open the image as a filesystem at offset: 0x00000000 with error: Possible encryption detected (High entropy (8.00))

I used FTK imager to create the image, therefore it cannot be encrypted. I was able to open it with autopsy, so the image itself is fine (not corrupt).

import pytsk3

image_path = "C:/Users/Karin/Desktop/images/USB2.E01"

image = pytsk3.Img_Info(image_path)   --> works correctly

fs = pytsk3.FS_Info(image)   --> **does not work**

root = fs.open_dir(path="/")

for entry in root:
    print(entry.info.name.name)

USB2.E01

Answer 1

E01 file is "forensically" created file. It's not a bit-to-bit copy of the source drive. It has additional information such as metadata and hashes of data chunks inside of it. Also this data could be compressed or not. So, usually the basic programming method of reading simple files would not work. I would recommend you to read more about the .E01 structure and check this library https://github.com/libyal/libewf