How to extract the MFT from an E01 image

If you don’t want to mount the image and extract the MFT manually (or if for some reason it isn’t shown when you mount it (yes, I’ve had that)), this comes in handy.

First run mmls /path/to/image.e01

This will print the offsets of the various partitions. Make a note of the offset for the NTFS partition (most likely 2048).

Carve it with icat like this:

icat -o <offset, 2048> image-file.E01 0 > image.mft

Afterwards, you can parse it with analyzeMFT like you would a normally extracted MFT.