Page 1 of 1

Here be the filesystem

Posted: October 16th, 2017, 15:27
by bos
Finally I managed to pin-point the SA-structure, and now I see the filesystem of this one chip from a pen-drive.

The filesystem-browser lets me extract files, but at this point I want to extract the whole image but I'm unable to see how I can achieve this.

Is this possible from the Log Image-element or do I need to add something else?

Re: Here be the filesystem

Posted: October 16th, 2017, 15:47
by Sasha Sheremetov
Absolutely,
Just go back to workspace and open dumpviewer (top toolbar) on the element you want to save dump from (usually it is Logical image). Then press "Save all" to save whole dump as bin file for further export to Rstudio/FTK/Encase/whatever you use.