Re: [sleuthkit-users] tsk_recover E01 extraction issues

[Gqman10 <gq...@gm...>]

Brian,

Try using affuse to make it look like one big file.

Sent from my iPhone

> On Mar 13, 2014, at 6:09 PM, Brian McHughs <br...@in...> wrote:
> 
> I have an image file (split King.E01, King.E02) that I'm trying to utilize the commandline tsk_recover to extract all allocated files into a specified output directory.
> 
> command I'm running:
> 
> tsk_recover ./King.E01 ./Output
> 
> I get:
> Cannot determine file system type (Sector offset: 0)Files Recovered: 0
> 
> 
> 
> So I updated my command to:
> 
> tsk_recover -f fat ./King.E01 ./Output
> 
> I get:
> 
> Invalid magic value (Not a FATFS file system (magic)) (Sector offset: 0)Files Recovered: 0
> 
> 
> 
> My goal is to simply extract everything in the E01 image files out into the Output directory.  Can anyone please tell me what I'm missing?
> 
> Environment
> 
> MAC: OS X 10.9.1
> 
> thanks,
> 
> Brian McHughs
> 
> 
> br...@in... (email)
> www.indexed.io (web)
> 888.840.0709 x101 (office)
> 303.900.3364 (cell)
> 
> ------------------------------------------------------------------------------
> Learn Graph Databases - Download FREE O'Reilly Book
> "Graph Databases" is the definitive new guide to graph databases and their
> applications. Written by three acclaimed leaders in the field,
> this first edition is now available. Download your free book today!
> http://p.sf.net/sfu/13534_NeoTech
> _______________________________________________
> sleuthkit-users mailing list
> https://lists.sourceforge.net/lists/listinfo/sleuthkit-users
> http://www.sleuthkit.org