tsk_recover and other tools image sequence

classic Classic list List threaded Threaded
2 messages Options
Reply | Threaded
Open this post in threaded view
|

tsk_recover and other tools image sequence

Edward Diener
The doc for tsk_recover specifies for the image(s):

"The disk or partition image to read, whose format is given with ’-i’.
Multiple image file names can be given if the image is split into
multiple segments. If only one image file is given, and its name is the
first in a sequence (e.g., as indicated by ending in ’.001’), subsequent
image segments will be included automatically. "

Does this also refer to ewf images whose sequence has endings starting
with .E01, E02, E03 etc. ? In other words if I pass as my image an ewf
image such as 'some_ewf_image.E01' will tsk_recover also process all the
other images in the sequence ?

The same question goes for all the other TSK tools which take the -i
parameter indicating the image(s) to pass to the tool.

Eddie Diener

------------------------------------------------------------------------------
What NetFlow Analyzer can do for you? Monitors network bandwidth and traffic
patterns at an interface-level. Reveals which users, apps, and protocols are
consuming the most bandwidth. Provides multi-vendor support for NetFlow,
J-Flow, sFlow and other flows. Make informed decisions using capacity planning
reports.http://sdm.link/zohodev2dev
_______________________________________________
sleuthkit-users mailing list
https://lists.sourceforge.net/lists/listinfo/sleuthkit-users
http://www.sleuthkit.org
Reply | Threaded
Open this post in threaded view
|

Re: tsk_recover and other tools image sequence

Brian Carrier-2
Yes, it will find E02, E03, etc.

> On Jul 20, 2016, at 1:17 PM, Edward Diener <[hidden email]> wrote:
>
> The doc for tsk_recover specifies for the image(s):
>
> "The disk or partition image to read, whose format is given with ’-i’.
> Multiple image file names can be given if the image is split into
> multiple segments. If only one image file is given, and its name is the
> first in a sequence (e.g., as indicated by ending in ’.001’), subsequent
> image segments will be included automatically. "
>
> Does this also refer to ewf images whose sequence has endings starting
> with .E01, E02, E03 etc. ? In other words if I pass as my image an ewf
> image such as 'some_ewf_image.E01' will tsk_recover also process all the
> other images in the sequence ?
>
> The same question goes for all the other TSK tools which take the -i
> parameter indicating the image(s) to pass to the tool.
>
> Eddie Diener
>
> ------------------------------------------------------------------------------
> What NetFlow Analyzer can do for you? Monitors network bandwidth and traffic
> patterns at an interface-level. Reveals which users, apps, and protocols are
> consuming the most bandwidth. Provides multi-vendor support for NetFlow,
> J-Flow, sFlow and other flows. Make informed decisions using capacity planning
> reports.http://sdm.link/zohodev2dev
> _______________________________________________
> sleuthkit-users mailing list
> https://lists.sourceforge.net/lists/listinfo/sleuthkit-users
> http://www.sleuthkit.org


------------------------------------------------------------------------------
What NetFlow Analyzer can do for you? Monitors network bandwidth and traffic
patterns at an interface-level. Reveals which users, apps, and protocols are
consuming the most bandwidth. Provides multi-vendor support for NetFlow,
J-Flow, sFlow and other flows. Make informed decisions using capacity planning
reports.http://sdm.link/zohodev2dev
_______________________________________________
sleuthkit-users mailing list
https://lists.sourceforge.net/lists/listinfo/sleuthkit-users
http://www.sleuthkit.org