Re: [sleuthkit-users] Restoring files

[Brian C. <ca...@sl...>]

On Feb 20, 2006, at 10:15 AM, gim...@we... wrote:

> On Thu, 16 Feb 2006 11:15:13 -0600
> "DePriest, Jason R." <jrd...@fi...> wrote:
>
>> I restored the file using Sleuthkit which the log says ran this:
>> icat -f ntfs -o 0 -i raw
>> '/sleuthkit-evidence/deadsystem/HOST/images/image.raw' 6754-128-3
>>
>> With 6754-128-3 being the MFT information.
>
> Thanks for the hint, used to build a shell script (ils + icat)!
>
> But what's the reason for Autopsy not providing a function to
> automatically restore large amount of files.

Time.... :)  And it wasn't really intended as a mass recovery tool.

brian