debian man page for tsk_recover

Query: tsk_recover

OS: debian

Section: 1

Format: Original Unix Latex Style Formatted with HTML and a Horizontal Scroll Bar

TSK_RECOVER(1)						      General Commands Manual						    TSK_RECOVER(1)

NAME
tsk_recover - Export files from an image into a local directory
SYNOPSIS
tsk_recover [-vVae] [-i imgtype ] [-b dev_sector_size ] [-o sector_offset ] [-d dir_inum ] image output_dir
DESCRIPTION
tsk_recover recover files to the output_dir from the image. By default recovers only unallocated files. With flags, it will export all files. The arguments are as follows: -v verbose output to stderr -V Print version -a Recover allocated files only -e Recover all files (allocated and unallocated) -i imgtype The format of the image file (use '-i list' for supported types) If not given, autodetection methods are used. -b dev_sector_size The size (in bytes) of the device sectors If not given, autodetection methods are used. -o sector_offset Sector offset for a volume to recover (recovers only that volume) If not given, will attempt to recover all volumes in image and save them to different folders. -d dir_inum Directory inum to recover from (must also specify a specific partition using -o or there must not be a volume system)
EXAMPLES
To recover only unallocated files from image.dd to the recovered directory: # tsk_recover ./recovered ./image.dd
AUTHOR
Brian Carrier <carrier at sleuthkit dot org> Send documentation updates to <doc-updates at sleuthkit dot org> TSK_RECOVER(1)
Related Man Pages
blkcalc(1) - debian
ffind(1) - debian
jls(1) - debian
mmcat(1) - debian
jls(1) - php
Similar Topics in the Unix Linux Community
recover deleted files
how to recover writing stream
Need to Recover Deleted Files
How to find unallocated partition.
How to recover the deleted file in Linux?