Re: [sleuthkit-users] Attempting to use fiwalk

[Brian C. <ca...@sl...>]

TSK commands should find the remaining files if you give it just the ".001" file.   Not sure about fiwalk's usage. 

Jeff, if you run tsk_gettimes on the image, then does it find all of them?



On Mar 27, 2015, at 1:27 PM, Jeff Scarborough <jef...@gm...> wrote:

> I am a new user to SleuthKit and I am attempting to run fiwalk on an image and output a dfxml file.  The image is, I believe called a split raw since it is in the form of filename.001, filename.002, filename.003 etc.  I am having an issue with the command line to output the file.  
> 
> The below command is the example i usually run across.
> 
> fiwalk -X path/report.xml path/image.raw
> 
> 
> I need to use fiwalk with split files.  I used the examples below with limited luck.
> 
> fiwalk -X path/report.xml path/image.dd  -- this one said it had trouble opening the file
> 
> fiwalk -X path/report.xml path/image.*  -- this one also has trouble
> 
> 
> The command line below seems to start the process but as far as I can see only processes the first file in the list and none of the others.
> 
> fiwalk -X path/report.xml path/image.001
> 
> 
> Am I missing something in the command line that will process all of the files?
> 
> I am using a virtual machine to run linux with SleuthKit installed and the image is on a USB drive.
> 
> Thanks,
> Jeff Scarborough
> ------------------------------------------------------------------------------
> Dive into the World of Parallel Programming The Go Parallel Website, sponsored
> by Intel and developed in partnership with Slashdot Media, is your hub for all
> things parallel software development, from weekly thought leadership blogs to
> news, videos, case studies, tutorials and more. Take a look and join the 
> conversation now. http://goparallel.sourceforge.net/_______________________________________________
> sleuthkit-users mailing list
> https://lists.sourceforge.net/lists/listinfo/sleuthkit-users
> http://www.sleuthkit.org