Re: [sleuthkit-users] Exfat recovery

[Dennis Z. <de...@es...>]

Hi,

Thanks for the fast response !

[root@localhost bin]# ./mmls  /home/dennis/Documents/disk.img
DOS Partition Table
Offset Sector: 0
Units are in 512-byte sectors

     Slot    Start        End          Length       Description
00:  Meta    0000000000   0000000000   0000000001   Primary Table (#0)
01:  -----   0000000000   0000002047   0000002048   Unallocated
02:  00:00   0000002048   0124735487   0124733440   Win95 FAT32 (0x0c)


On Sat, Jan 31, 2015 at 4:08 AM, Kalin KOZHUHAROV <me....@gm...>
wrote:

>
> On Jan 31, 2015 10:41 AM, "Dennis Zheleznyak" <de...@es...>
> wrote:
> > I'm trying to recover deleted data from an SD card that I pulled out of
> a smartphone.
> >
> > I backed up the image using:
> >
> >> dd if=/dev/sdb of=/tmp/disk.img
> >
> >
> > However, when I try to recover the files using the following command:
> >
> >> usr/local/sleuthkit/bin/fls -r -p disk.img | less
> >
> >
> > I get the following error:
> >
> >> Cannot determine file system type
> >
> >
> Not sure exfat is supported and cannot test right now, but what is the
> output of `mmls disk.img`
>
> May be you need offset (it used partitions) ?
>
> Kalin.
>