Re: [sleuthkit-users] tsk_recover whole dd image

[<sle...@fa...>]

I investigated my problem a bit further. tsk_recover calls tsk_fs_open_img() (in auto.cpp, line 439). So if I don't provide an offset it tries to open a file system at offset 0 instead of walking through the volume system to find the file systems first. I don't know how useful a patch for this "issue" would be since other tools already spit out the respective offset(s) and one could just call tsk_recover from a script (like Nanni's).

-----Original message-----
Sent: Wednesday, 25 November 2015 at 08:47:40
From: sle...@fa...
To: sleuthkit-users <sle...@li...>
Subject: Re: [sleuthkit-users] tsk_recover whole dd image
Without specifying the offset I get the same output as before. 
Thanks Nanni, I will have a look at this.

>-----Original message-----
>Sent: Tuesday, 24 November 2015 at 17:15:14
>From: "Derrick Karpo" <dk...@gm...>
>To: sle...@fa...
>Subject: Re: [sleuthkit-users] tsk_recover whole dd image
>Hello.
>
>What happens when you run it without the offset, but leave the sector size?
>
>Derrick
>

------------------------------------------------------------------------------
Go from Idea to Many App Stores Faster with Intel(R) XDK
Give your users amazing mobile app experiences with Intel(R) XDK.
Use one codebase in this all-in-one HTML5 development environment.
Design, debug & build mobile apps & 2D/3D high-impact games for multiple OSs.
http://pubads.g.doubleclick.net/gampad/clk?id=254741551&iu=/4140
_______________________________________________
sleuthkit-users mailing list
https://lists.sourceforge.net/lists/listinfo/sleuthkit-users
http://www.sleuthkit.org