Re: [sleuthkit-users] wrong filesystem ?
Brought to you by:
carrier
From: Antoine J. <aja...@lp...> - 2003-05-19 23:04:01
|
On Monday 19 May 2003 21:20, Brian Carrier wrote: > The 'dls -e' should be equivalent to using 'dd'. So, I would expect > it to work. What happens if you use 'dd' and grab the first 100 MB > and run the sleuth kit tools on that: It did work, thanks a lot :) Now, I don't want to ask stupid questions on the list, so I was wondering if there was some kind of howto somewhere for recovering files. I tried to use the Coroner Toolkit before knowing about your software, but I realised that it would take a month of more to recover my data (30Go), so I was wondering if there was a way to extract only the needed data from the image instead of all. Englidh is not my first language and I'm having a hard time understanding autopsy. Thanks a lot for your former answer. Regards. Antoine |