Re: [sleuthkit-users] LONG loading time - Multiple Exports at a time possible?

[Brian C. <ca...@sl...>]

Jennifer Smith wrote:
> I have loaded the .dd into Autopsy with no problem, but once I go to the File Analysis screen, if I click on a file that is large (e.g. this happened with both a 23 MB file and a 400 MB file; the dd is 4 GB) it takes HOURS for the file to "load" into the browser to where I can click "Export" to copy the file out.
> 
> Is there a way to mass export the files from either Sleuthkit or Autopsy?  I was hoping to either have the option of selecting entire directories, or even all files.  I don't expect checkboxes to select individual files (as cool as that would be!), but it is very time intensive to have to individually load and export each file.

In Autopsy, there is no such feature. You can probably click on the 
"inode" address of a file and goto the Metadata view.  From there you 
can save the file contents and this would save the time required to load 
the large file into the HTML browser (which do not like large files). 
But, that is not a mass extraction.

You could script it in TSK, if you had the desire.

brian