[sleuthkit-users] tsk_recover and other tools image sequence
Brought to you by:
carrier
From: Edward D. <eld...@tr...> - 2016-07-20 17:17:31
|
The doc for tsk_recover specifies for the image(s): "The disk or partition image to read, whose format is given with ’-i’. Multiple image file names can be given if the image is split into multiple segments. If only one image file is given, and its name is the first in a sequence (e.g., as indicated by ending in ’.001’), subsequent image segments will be included automatically. " Does this also refer to ewf images whose sequence has endings starting with .E01, E02, E03 etc. ? In other words if I pass as my image an ewf image such as 'some_ewf_image.E01' will tsk_recover also process all the other images in the sequence ? The same question goes for all the other TSK tools which take the -i parameter indicating the image(s) to pass to the tool. Eddie Diener |