Re: [sleuthkit-users] extracting .E01 and .Ex01 metadata

[Brian C. <ca...@sl...>]

On Sep 16, 2013, at 5:24 AM, Bala <bal...@cs...> wrote:

> Simson
>  
> Here’s what I’m trying to do. Develop a program on .Net platform to do the following.
>  
> 1.       Extract metadata from the forensic image (Investigator, case number etc.)
> 2.       Iterate over files in the file structure on .E01 and .Ex01 images and read/copy the files
> I can’t use the tools (.exe) which you have mentioned as they are. The best would be to write my own wrapper in a .Net language and make calls to the sleuth kit API to do the above. Hence the reason for me to ask my previous question

Have you looked into this project:

http://sleuthkitsharp.codeplex.com/

>  BTW tsk_recover doesn’t seem to iterate over files in the file structure on .E01 and .Ex01 images and read/copy the files. Is there another tool which I could use for this purpose ?

It should.  That's its only purpose in life.  Are you getting an error?