Here be the filesystem
October 16th, 2017, 15:27
Finally I managed to pin-point the SA-structure, and now I see the filesystem of this one chip from a pen-drive.
The filesystem-browser lets me extract files, but at this point I want to extract the whole image but I'm unable to see how I can achieve this.
Is this possible from the Log Image-element or do I need to add something else?
The filesystem-browser lets me extract files, but at this point I want to extract the whole image but I'm unable to see how I can achieve this.
Is this possible from the Log Image-element or do I need to add something else?
- Attachments
-
- log_image.png (13.4 KiB) Viewed 7862 times
Re: Here be the filesystem
October 16th, 2017, 15:47
Absolutely,
Just go back to workspace and open dumpviewer (top toolbar) on the element you want to save dump from (usually it is Logical image). Then press "Save all" to save whole dump as bin file for further export to Rstudio/FTK/Encase/whatever you use.
Just go back to workspace and open dumpviewer (top toolbar) on the element you want to save dump from (usually it is Logical image). Then press "Save all" to save whole dump as bin file for further export to Rstudio/FTK/Encase/whatever you use.
Powered by phpBB © phpBB Group.