Re: [sleuthkit-users] [sleuthkit-announce] TSK 4.1.1 is available

[Brian C. <ca...@sl...>]

Yea.  If you use Cellebrite to acquire an SD card or other large media, it splits the image up using a naming convention different than what TSK would detect.  As I recall, it's something like:

image.bin
image(2).bin

If you point TSK at image.bin, it will now find image(2).bin, etc.


On Sep 25, 2013, at 10:54 AM, "Armet, Lee" <Lee...@td...> wrote:

> Cellebrite disk image --- so like... mobile image data ?? 
> 
> Regards, 
> 
> Lee Armet | Senior Investigator, Digital Evidence | Global Security & Investigations | TD Bank Group‪ 
> T: (416) 982-6855 | M: (647) 242-0002
> 
> -----Original Message-----
> From: Brian Carrier [mailto:ca...@sl...] 
> Sent: Wednesday, September 25, 2013 9:11 AM
> To: sle...@li... Users; sle...@li...
> Subject: Re: [sleuthkit-users] [sleuthkit-announce] TSK 4.1.1 is available
> 
> Note that a last minute inclusion of a fiwalk patch means that this will not compile in some cases on Linux (and apparently FreeBSD).  We're testing the patch and will likely have a new release soon.  Sorry about that.  
> 
> 
> On Sep 24, 2013, at 11:00 PM, Brian Carrier <ca...@sl...> wrote:
> 
>> New version is on the website.  Mostly bug fixes.  
>> 
>> 	http://www.sleuthkit.org/sleuthkit
>> 
>> Updates:
>> 	• FILE_NAME times in timelines
>> 	• Cellebrite disk image auto-detect
>> 	• 64-bit windows targets
>> 	• Fixed bug with Sqlite code not using NTFS Sequence
>> 	• Jar files have native libraries in them
>> 
>> Corresponding autopsy release will come soon...
>> 
>> 
>> ----------------------------------------------------------------------
>> -------- October Webinars: Code for Performance Free Intel webinars 
>> can help you accelerate application performance.
>> Explore tips for MPI, OpenMP, advanced profiling, and more. Get the 
>> most from the latest Intel processors and coprocessors. See abstracts 
>> and register > 
>> http://pubads.g.doubleclick.net/gampad/clk?id=60133471&iu=/4140/ostg.c
>> lktrk _______________________________________________
>> sleuthkit-announce mailing list
>> sle...@li...
>> https://lists.sourceforge.net/lists/listinfo/sleuthkit-announce
> 
> 
> ------------------------------------------------------------------------------
> October Webinars: Code for Performance
> Free Intel webinars can help you accelerate application performance.
> Explore tips for MPI, OpenMP, advanced profiling, and more. Get the most from the latest Intel processors and coprocessors. See abstracts and register > http://pubads.g.doubleclick.net/gampad/clk?id=60133471&iu=/4140/ostg.clktrk
> _______________________________________________
> sleuthkit-users mailing list
> https://lists.sourceforge.net/lists/listinfo/sleuthkit-users
> http://www.sleuthkit.org
> 
> NOTICE: Confidential message which may be privileged. Unauthorized use/disclosure prohibited. If received in error, please go to www.td.com/legal for instructions.
> AVIS : Message confidentiel dont le contenu peut être privilégié. Utilisation/divulgation interdites sans permission. Si reçu par erreur, prière d'aller au www.td.com/francais/avis_juridique pour des instructions.
> ------------------------------------------------------------------------------
> October Webinars: Code for Performance
> Free Intel webinars can help you accelerate application performance.
> Explore tips for MPI, OpenMP, advanced profiling, and more. Get the most from 
> the latest Intel processors and coprocessors. See abstracts and register >
> http://pubads.g.doubleclick.net/gampad/clk?id=60133471&iu=/4140/ostg.clktrk
> _______________________________________________
> sleuthkit-users mailing list
> https://lists.sourceforge.net/lists/listinfo/sleuthkit-users
> http://www.sleuthkit.org