sleuthkit-users

Re: [sleuthkit-users] Restoring files

[<gim...@we...>]

On Thu, 16 Feb 2006 11:15:13 -0600
"DePriest, Jason R." <jrd...@fi...> wrote:

> I restored the file using Sleuthkit which the log says ran this:
> icat -f ntfs -o 0 -i raw
> '/sleuthkit-evidence/deadsystem/HOST/images/image.raw' 6754-128-3
> 
> With 6754-128-3 being the MFT information.

Thanks for the hint, used to build a shell script (ils + icat)!

But what's the reason for Autopsy not providing a function to
automatically restore large amount of files. Or is there any option i
did overlook?

regards

Re: [sleuthkit-users] Restoring files

[Bill M. <bi...@bf...>]

On Feb 20, 2006, at 15:15, gimeshell wrote:

> Thanks for the hint, used to build a shell script (ils + icat)!

So this shell script helps automate some of the recovery work then?  
Interested in sharing?

Thanks,
-Bill

-----
Bill McGonigle, Owner           Work: 603.448.4440
BFC Computing, LLC              Home: 603.448.1668
bi...@bf...           Cell: 603.252.2606
http://www.bfccomputing.com/    Page: 603.442.1833
Blog: http://blog.bfccomputing.com/
VCard: http://bfccomputing.com/vcard/bill.vcf

Re: [sleuthkit-users] Restoring files

[<gim...@we...>]

On Mon, 27 Feb 2006 11:59:47 -0500
Bill McGonigle <bi...@bf...> wrote:

> So this shell script helps automate some of the recovery work then?  
> Interested in sharing?
> 

It's only a quick and dirty solution...
Shell script works similiar to this one:

http://forums.gentoo.org/viewtopic-t-365703.html

There's another script (from perhaps many out there) at

http://metawire.org/~henk/recoup

but i didn't make it run for me.

(

$ perl recoup.pl 
main::list() called too early to check prototype at recoup.pl line 33.

$ vi recoup.pl
line 33:
list($FLS_inode);

)

regards

Re: [sleuthkit-users] Restoring files

[Brian C. <ca...@sl...>]

On Feb 20, 2006, at 10:15 AM, gim...@we... wrote:

> On Thu, 16 Feb 2006 11:15:13 -0600
> "DePriest, Jason R." <jrd...@fi...> wrote:
>
>> I restored the file using Sleuthkit which the log says ran this:
>> icat -f ntfs -o 0 -i raw
>> '/sleuthkit-evidence/deadsystem/HOST/images/image.raw' 6754-128-3
>>
>> With 6754-128-3 being the MFT information.
>
> Thanks for the hint, used to build a shell script (ils + icat)!
>
> But what's the reason for Autopsy not providing a function to
> automatically restore large amount of files.

Time.... :)  And it wasn't really intended as a mass recovery tool.

brian