Re: [sleuthkit-users] Refining keyword searches
Brought to you by:
carrier
From: Silent P. <sp...@si...> - 2003-03-15 21:51:37
|
Quoting: "Brian Carrier" > Your best bet would be to mount the image in loopback and run a grep > script. I have no clue exactly what it would be though. It would look > something like this for one keyword: Task/Autopsy have information regarding hidden / deleted files. When it works with images, does it undelete such files into the image so that they are available for manual searching if the image is mounted in loopback? Sid. |