weyne/kaliwiki
1
0
Fork 0
mirror of https://github.com/mubix/kaliwiki.git synced 2025-10-29 16:59:26 +00:00
Code Issues Packages Projects Releases Wiki Activity
kaliwiki/tools/tsk_recover.md
Stefan Molls 788305a83e Added forensics section
2014-04-23 10:38:32 -05:00

1.0 KiB
Raw Blame History

tsk_recover

Notes

tsk_recover recover files to the output_dir from the image. By default recovers only unallocated files. With flags, it will export all files.

Help Text

usage: tsk_recover [-vVae] [-f fstype] [-i imgtype] [-b dev_sector_size] [-o sector_offset] [-d dir_inum] image [image] output_dir
	-i imgtype: The format of the image file (use '-i list' for supported types)
	-b dev_sector_size: The size (in bytes) of the device sectors
	-f fstype: The file system type (use '-f list' for supported types)
	-v: verbose output to stderr
	-V: Print version
	-a: Recover allocated files only
	-e: Recover all files (allocated and unallocated)
	-o sector_offset: sector offset for a volume to recover (recovers only that volume)
	-d dir_inum: Directory inum to recover from (must also specify a specific partition using -o or there must not be a volume system)

Example Usage

To recover only unallocated files from image.dd to the recovered directory:

 # tsk_recover ./recovered ./image.dd

Links