[sleuthkit-users] Extract files not in NSRL

[Santiago <san...@gm...>]

Hi all, maybe you can help me with this:

I have:

a) E01 Image.
b) Indexed hash database. (NSRL)
c) hfind working well with hash database.

I need to extract all files from E01 image that are NOT in the hash
database. So I need not known files.

And if possible, export the files with the original path and directory
strcuture they had in the image.

I've tried with sleutkit framework, but could not make it work,

Any ideas ?

Many Thanks
Santiago