Re: [sleuthkit-users] tsk_recover whole dd image

[Derrick K. <dk...@gm...>]

Hello.

What happens when you run it without the offset, but leave the sector size?

Derrick


On Tue, Nov 24, 2015 at 7:03 AM,  <sle...@fa...> wrote:
> This command runs fine. Good so far, but I want to automate the whole process, so just giving the image as argument should be enough so that all partitions are processed.
>
> -----Original message-----
> Sent: Tuesday, 24 November 2015 at 14:34:04
> From: "Derrick Karpo" <dk...@gm...>
> To: sle...@fa...
> Subject: Re: [sleuthkit-users] tsk_recover whole dd image
> Hello.
>
> What happens if you run it against a single partition with an offset,
> and force the sector size like this?
>
>   `tsk_recover -v -e -i raw -o 206848 -b 512 wip/image.dd recovered'
>
> Derrick
>
> ------------------------------------------------------------------------------
> Go from Idea to Many App Stores Faster with Intel(R) XDK
> Give your users amazing mobile app experiences with Intel(R) XDK.
> Use one codebase in this all-in-one HTML5 development environment.
> Design, debug & build mobile apps & 2D/3D high-impact games for multiple OSs.
> http://pubads.g.doubleclick.net/gampad/clk?id=254741551&iu=/4140
> _______________________________________________
> sleuthkit-users mailing list
> https://lists.sourceforge.net/lists/listinfo/sleuthkit-users
> http://www.sleuthkit.org