Re: [sleuthkit-users] Photorec carver
Brought to you by:
carrier
Menu
▾
▴
Re: [sleuthkit-users] Photorec carver
|
From: Nanni B. <dig...@gm...> - 2015-02-17 20:01:30
|
It could be useful to run Photorec only on the unallocated space and the a special module for deleting the duplicated files by hash comparison. Deleted files and carved files compared and the carved files duplicated deleted... I made this procedure in KS http://articles.forensicfocus.com/2013/04/23/ks-an-open-source-bash-script-for-indexing-data/ I hope this could be a nice advice ;) -- Dr. Nanni Bassetti http://www.nannibassetti.com CAINE project manager - http://www.caine-live.net |
