Re: [sleuthkit-users] Restoring files

[<gim...@we...>]

On Thu, 16 Feb 2006 11:15:13 -0600
"DePriest, Jason R." <jrd...@fi...> wrote:

> I restored the file using Sleuthkit which the log says ran this:
> icat -f ntfs -o 0 -i raw
> '/sleuthkit-evidence/deadsystem/HOST/images/image.raw' 6754-128-3
> 
> With 6754-128-3 being the MFT information.

Thanks for the hint, used to build a shell script (ils + icat)!

But what's the reason for Autopsy not providing a function to
automatically restore large amount of files. Or is there any option i
did overlook?

regards