Re: [sleuthkit-users] Fiwalk on running system

[Michael C. <scu...@gm...>]

Does it work if you give it the volume name? fiwalk \\.\C:

On 18 September 2015 at 14:50, Rolf Inator <rol...@gm...> wrote:
> Hi list,
>
> I wonder if it's possible to run fiwalk on a live system? The documentation says
> user@forensicbox:~$ fiwalk
> usage: fiwalk [options] iso-name
>
> The problem I am facing is, that if I want to run fiwalk over a bitlocker encrypted dd image, I have to install Dislocker (a new driver) on my Linux system. It would be more decent if I could just run the fiwalk Windows executable while the suspects system is still running.
>
> I hope that was clear :)
>
> Kind regards,
> Rolf
>
> ------------------------------------------------------------------------------
> _______________________________________________
> sleuthkit-users mailing list
> https://lists.sourceforge.net/lists/listinfo/sleuthkit-users
> http://www.sleuthkit.org