You will need to use tools like foremost for that purpose.
brian
On Jan 24, 2005, at 9:26 PM, Aaron Peterson wrote:
> The sluethkit tools are only applicable to the current filesystem,
> correct? For instance, I can't tell the tools to survey the raw drive
> for files that still exist that were probably part of a previous
> filesystem that has since been overwritten?
>
> Aaron
>
>
> -------------------------------------------------------
> This SF.Net email is sponsored by: IntelliVIEW -- Interactive Reporting
> Tool for open source databases. Create drag-&-drop reports. Save time
> by over 75%! Publish reports on the web. Export to DOC, XLS, RTF, etc.
> Download a FREE copy at http://www.intelliview.com/go/osdn_nl
> _______________________________________________
> sleuthkit-users mailing list
> https://lists.sourceforge.net/lists/listinfo/sleuthkit-users
> http://www.sleuthkit.org
>
>
|
