Re: [sleuthkit-users] extracting .E01 and .Ex01 metadata
Brought to you by:
carrier
Menu
▾
▴
Re: [sleuthkit-users] extracting .E01 and .Ex01 metadata
|
From: Bala <bal...@cs...> - 2013-09-13 05:50:21
|
Simson I presume ewfinfo & tsk_recover would suit me ideally according to the descriptions that I find, however I' unable to locate both their method signature which could help me write a manged .Net code to call them. Could you help me find them (method signatures) in this please. http://www.sleuthkit.org/sleuthkit/docs/api-docs/index.html Regards Bala From: Simson Garfinkel [mailto:si...@gm...] On Behalf Of Simson Garfinkel Sent: Thursday, September 12, 2013 5:47 PM To: Bala Cc: sle...@li... Subject: Re: [sleuthkit-users] extracting .E01 and .Ex01 metadata Why do you want to use classes and methods? For #1 - what do you mean by "metadata"? Do you want to use ewfinfo? For #2 - Perhaps you want to use tsk_recover? On Sep 12, 2013, at 3:27 AM, "Bala" <bal...@cs...> wrote: Hi Guys I'm a newbie to TSK. Could someone help me figure out which classes and methods that I need to use to get the following details from .E01 and Ex01 files 1. Extract metadata from the forensic image 2. Iterate over files in the file structure on .E01 and .Ex01 images and read/copy the files. Environment TSK Version 4.1.0 Core ( not the framework) OS version window 7/ windows 2008 R2 Regards Bala ---------------------------------------------------------------------------- -- How ServiceNow helps IT people transform IT departments: 1. Consolidate legacy IT systems to a single system of record for IT 2. Standardize and globalize service processes across IT 3. Implement zero-touch automation to replace manual, redundant tasks <http://pubads.g.doubleclick.net/gampad/clk?id=51271111&iu=/4140/ostg.clktrk _______________________________________________> http://pubads.g.doubleclick.net/gampad/clk?id=51271111&iu=/4140/ostg.clktrk_ ______________________________________________ sleuthkit-users mailing list <https://lists.sourceforge.net/lists/listinfo/sleuthkit-users> https://lists.sourceforge.net/lists/listinfo/sleuthkit-users <http://www.sleuthkit.org> http://www.sleuthkit.org |
