Re: [sleuthkit-users] Refining keyword searches

[Silent P. <sp...@si...>]

Quoting: "Brian Carrier"
> Your best bet would be to mount the image in loopback and run a grep
> script.  I have no clue exactly what it would be though.  It would look
> something like this for one keyword:

Task/Autopsy have information regarding hidden / deleted files. When it works
with images, does it undelete such files into the image so that they are
available for manual searching if the image is mounted in loopback?

Sid.