Re: [sleuthkit-users] tsk_recover E01 extraction issues

[Grundy B. J T. <Bar...@ti...>]

Have you run mmls on the image to determine if there is a file system offset?

/*******************************************
Barry J. Grundy
Assistant Special Agent in Charge
Digital Forensic Support Group
Electronic Crimes and Intelligence Division
Treasury Inspector General for Tax Administration
(301) 210-8741 (w)
(202) 527-5778 (c)
Bar...@ti...
********************************************\

From: Brian McHughs [mailto:br...@in...]
Sent: Thursday, March 13, 2014 6:10 PM
To: sle...@li...
Subject: [sleuthkit-users] tsk_recover E01 extraction issues

I have an image file (split King.E01, King.E02) that I'm trying to utilize the commandline tsk_recover to extract all allocated files into a specified output directory.

command I'm running:

tsk_recover ./King.E01 ./Output

I get:

Cannot determine file system type (Sector offset: 0)Files Recovered: 0



So I updated my command to:

tsk_recover -f fat ./King.E01 ./Output

I get:

Invalid magic value (Not a FATFS file system (magic)) (Sector offset: 0)Files Recovered: 0



My goal is to simply extract everything in the E01 image files out into the Output directory.  Can anyone please tell me what I'm missing?

Environment

MAC: OS X 10.9.1

thanks,
Brian McHughs

[http://www.indexed.io/wp-content/uploads/2013/11/iio_logo_medium.png]
br...@in...<mailto:br...@in...> (email)
www.indexed.io<http://www.indexed.io> (web)
888.840.0709 x101 (office)
303.900.3364 (cell)