TSK_RECOVER(1) General Commands Manual TSK_RECOVER(1)NAME
tsk_recover - Export files from an image into a local directory
SYNOPSIS
tsk_recover [-vVae] [-i imgtype ] [-b dev_sector_size ] [-o sector_offset ] [-d dir_inum ] image output_dir
DESCRIPTION
tsk_recover recover files to the output_dir from the image. By default recovers only unallocated files. With flags, it will export all
files.
The arguments are as follows:
-v verbose output to stderr
-V Print version
-a Recover allocated files only
-e Recover all files (allocated and unallocated)
-i imgtype
The format of the image file (use '-i list' for supported types) If not given, autodetection methods are used.
-b dev_sector_size
The size (in bytes) of the device sectors If not given, autodetection methods are used.
-o sector_offset
Sector offset for a volume to recover (recovers only that volume) If not given, will attempt to recover all volumes in image and
save them to different folders.
-d dir_inum
Directory inum to recover from (must also specify a specific partition using -o or there must not be a volume system)
EXAMPLES
To recover only unallocated files from image.dd to the recovered directory:
# tsk_recover ./recovered ./image.dd
AUTHOR
Brian Carrier <carrier at sleuthkit dot org>
Send documentation updates to <doc-updates at sleuthkit dot org>
TSK_RECOVER(1)
Check Out this Related Man Page
MMCAT(1) General Commands Manual MMCAT(1)NAME
mmcat - Output the contents of a partition to stdout
SYNOPSIS
mmcat [-t mmtype ] [-o offset ] [ -i imgtype ] [-b dev_sector_size] [-vV] image [images] part_num
DESCRIPTION
mmcat outputs the contents of a specific volume to stdout. This allows you to extract the contents of a partition to a separate file.
ARGUMENTS -t mmtype
Specify the media management type. Use '-t list' to list the supported types. If not given, autodetection methods are used.
-o offset
Specify the offset into the image where the volume containing the partition system starts. The relative offset of the partition
system will be added to this value.
-b dev_sector_size
The size, in bytes, of the underlying device sectors. If not given, the value in the image format is used (if it exists) or
512-bytes is assumed.
-i imgtype
Identify the type of image file, such as raw or split. If not given, autodetection methods are used.
-v Verbose output of debugging statements to stderr
-V Display version
image [images]
One (or more if split) disk images whose format is given with '-i'.
part_num
Address of partition to process. See the mmls output to determine the address of the partitions.
AUTHOR
Brian Carrier <carrier at sleuthkit dot org>
Send documentation updates to <doc-updates at sleuthkit dot org>
MMCAT(1)
ok so I'm having major issues trying to figure this out:
I have this program that I'm inputting the files in hte current directory which are image files...it spits out 5 line chunks describing the files...
filename: (name of file)
size: (100 x 200)
arbitrary data
arbitrary data
arbitrary... (4 Replies)
Hello,
I'm spendind hours trying to figure out how a script could remove files and folders older than 30days in a given volume (/dataVolumes/Booba.1.0).
Within this volume, all users have their personal folder that starts with "RC-..", so the script should skip them for deletion.
I will... (4 Replies)
SunOS 5.8
this command launchs my server:
./some_java_application > stdout.log 2>&1 &
tha stdout.log file was deleted
Q1) Is there a way to recover or redirect the writing stream without restart tha application?
Q2) If not Q1, is there a way to launch the application so I can see the... (3 Replies)
Hi Experts,
by mistake i deleted some files that are very important to the project.
is there any way that i can recover those files,there is no backup for that but the details of the file we know.
This will be a great help.
Thanks (5 Replies)
I used flot to create a graph and I would like to be able to save/export the graph as an image. In firefox on windows you can just ctl rt-click and you have a save as image feature (which I can automate with js) but...I need this to work on a linux browser. On linux in firefox I can print preview... (11 Replies)
My Solaris system administrator has doing troubleshooting to my server. He has accidental remove the hardware raid. Is it possible to recover it back? (4 Replies)
Hi,
By mistake, executed the following command :
rm -rf *
and ALL files got deleted.
But I need to get back these files as they are very very important.
Please help me how to recover this file. Its Urgent for me please.
Thanks in advance. (6 Replies)
I had ACER aspiron one netbook with dual bootable (Windows XP and Debian). Recently I found XP is messy and Debian has new version published. I plan to recover XP and install new version of Debian. But I failed to recover XP from Hidden Partition.
I thought it is because I install GRUB in the... (15 Replies)
Hi,
I am working Linux server machine. Somebody by mistake(or may be knowingly) deleted few folders and files from the machine. How is this possible to recover those files and folders????:confused:
I normally logged in through Putty and winscp only. And don't have any history for putty... (8 Replies)
HI, I'm trying to find the unallocated space in console mode from my hard disk. I tried " df-hk and fdisk" commands, but either of the commands are not listing out the unallocated space. It's just listing the existing partition. please let me know how to list that and partition that in text mode. (3 Replies)