HDD GURU FORUMS
http://forum.hddguru.com/

Here be the filesystem
http://forum.hddguru.com/viewtopic.php?f=27&t=35957
Page 1 of 1

Author:  bos [ October 16th, 2017, 15:27 ]
Post subject:  Here be the filesystem

Finally I managed to pin-point the SA-structure, and now I see the filesystem of this one chip from a pen-drive.

The filesystem-browser lets me extract files, but at this point I want to extract the whole image but I'm unable to see how I can achieve this.

Is this possible from the Log Image-element or do I need to add something else?

Attachments:
log_image.png
log_image.png [ 13.4 KiB | Viewed 1908 times ]

Author:  Sasha Sheremetov [ October 16th, 2017, 15:47 ]
Post subject:  Re: Here be the filesystem

Absolutely,
Just go back to workspace and open dumpviewer (top toolbar) on the element you want to save dump from (usually it is Logical image). Then press "Save all" to save whole dump as bin file for further export to Rstudio/FTK/Encase/whatever you use.

Page 1 of 1 All times are UTC - 5 hours [ DST ]
Powered by phpBB © 2000, 2002, 2005, 2007 phpBB Group
http://www.phpbb.com/