Use blkls to carve out the unallocated from your image, then use either
foremost or scalpel to pull files from your unallocated collection.
R/
Jason Wright
On Sep 24, 2013 1:44 AM, "Bala" <bal...@cs...> wrote:
> Hi****
>
> I need to find files in unallocated space and extract them from the
> forensic image. ****
>
> Is this something that could be done with SleuthKit in the first place, If
> YES could someone help me with the exact tool that I could use for this
> purpose and the commands if there exists any.****
>
> ** **
>
> Regards****
>
> Bala****
>
> ** **
>
>
> ------------------------------------------------------------------------------
> October Webinars: Code for Performance
> Free Intel webinars can help you accelerate application performance.
> Explore tips for MPI, OpenMP, advanced profiling, and more. Get the most
> from
> the latest Intel processors and coprocessors. See abstracts and register >
> http://pubads.g.doubleclick.net/gampad/clk?id=60133471&iu=/4140/ostg.clktrk
> _______________________________________________
> sleuthkit-users mailing list
> https://lists.sourceforge.net/lists/listinfo/sleuthkit-users
> http://www.sleuthkit.org
>
>
|
