Re: [sleuthkit-users] tsk_recover and other tools image sequence

[Brian C. <ca...@sl...>]

Yes, it will find E02, E03, etc.

> On Jul 20, 2016, at 1:17 PM, Edward Diener <eld...@tr...> wrote:
> 
> The doc for tsk_recover specifies for the image(s):
> 
> "The disk or partition image to read, whose format is given with ’-i’. 
> Multiple image file names can be given if the image is split into 
> multiple segments. If only one image file is given, and its name is the 
> first in a sequence (e.g., as indicated by ending in ’.001’), subsequent 
> image segments will be included automatically. "
> 
> Does this also refer to ewf images whose sequence has endings starting 
> with .E01, E02, E03 etc. ? In other words if I pass as my image an ewf 
> image such as 'some_ewf_image.E01' will tsk_recover also process all the 
> other images in the sequence ?
> 
> The same question goes for all the other TSK tools which take the -i 
> parameter indicating the image(s) to pass to the tool.
> 
> Eddie Diener
> 
> ------------------------------------------------------------------------------
> What NetFlow Analyzer can do for you? Monitors network bandwidth and traffic
> patterns at an interface-level. Reveals which users, apps, and protocols are 
> consuming the most bandwidth. Provides multi-vendor support for NetFlow, 
> J-Flow, sFlow and other flows. Make informed decisions using capacity planning
> reports.http://sdm.link/zohodev2dev
> _______________________________________________
> sleuthkit-users mailing list
> https://lists.sourceforge.net/lists/listinfo/sleuthkit-users
> http://www.sleuthkit.org