[sleuthkit-users] tsk_recover E01 extraction issues

[Brian M. <br...@in...>]

I have an image file (split King.E01, King.E02) that I'm trying to utilize
the commandline tsk_recover to extract all allocated files into a specified
output directory.

command I'm running:

tsk_recover ./King.E01 ./Output

I get:

Cannot determine file system type (Sector offset: 0)Files Recovered: 0


So I updated my command to:

tsk_recover -f fat ./King.E01 ./Output

I get:

Invalid magic value (Not a FATFS file system (magic)) (Sector offset:
0)Files Recovered: 0


My goal is to simply extract everything in the E01 image files out into the
Output directory.  Can anyone please tell me what I'm missing?

Environment

MAC: OS X 10.9.1

thanks,
Brian McHughs


br...@in... (email)
www.indexed.io (web)
888.840.0709 x101 (office)
303.900.3364 (cell)