[sleuthkit-users] Fiwalk on running system

[Rolf I. <rol...@gm...>]

Hi list,

I wonder if it's possible to run fiwalk on a live system? The documentation says
user@forensicbox:~$ fiwalk 
usage: fiwalk [options] iso-name

The problem I am facing is, that if I want to run fiwalk over a bitlocker encrypted dd image, I have to install Dislocker (a new driver) on my Linux system. It would be more decent if I could just run the fiwalk Windows executable while the suspects system is still running.

I hope that was clear :)

Kind regards,
Rolf