[sleuthkit-users] Attempting to use fiwalk

[Jeff S. <jef...@gm...>]

I am a new user to SleuthKit and I am attempting to run fiwalk on an image
and output a dfxml file.  The image is, I believe called a split raw since
it is in the form of filename.001, filename.002, filename.003 etc.  I am
having an issue with the command line to output the file.

The below command is the example i usually run across.

fiwalk -X path/report.xml path/image.raw


I need to use fiwalk with split files.  I used the examples below with
limited luck.

fiwalk -X path/report.xml path/image.dd  -- this one said it had trouble
opening the file

fiwalk -X path/report.xml path/image.*  -- this one also has trouble


The command line below seems to start the process but as far as I can see
only processes the first file in the list and none of the others.

fiwalk -X path/report.xml path/image.001


Am I missing something in the command line that will process all of the
files?

I am using a virtual machine to run linux with SleuthKit installed and the
image is on a USB drive.

Thanks,
Jeff Scarborough