Sleuth Kit and Spli...
 
Notifications
Clear all

Sleuth Kit and Split E01 Images

4 Posts
3 Users
0 Reactions
2,559 Views
(@twjolson)
Honorable Member
Joined: 17 years ago
Posts: 417
Topic starter  

I probably am missing something stupid and simple, but I can't figure this out. I have an E01 image, split into 650 mb chuncks.

I tried using the -i split option, along with <image>.E??, but sluethkit, mmls specifically, couldn't read the image.

I tried using -i ewf option, and it couldn't read it then either.

I even tried -i split,ewf, and mmls bawked at that, as I expected.

As a test, I tried a whole E01 image, and it read it just fine. So libewf is installed and working.

Anyone have an idea of how to do this?

Any help would be greatly appreciated


   
Quote
(@indur)
Trusted Member
Joined: 17 years ago
Posts: 67
 

You shouldn't need any -i option, just to specify on the command line every image file in the correct order, e.g., mmls <image>.e*.

I would check the list of images parts you're passing to mmls with something like echo, e.g., echo <image>.e*.


   
ReplyQuote
lucpel
(@lucpel)
Trusted Member
Joined: 14 years ago
Posts: 55
 

This should work

# mmls -t dos -i ewf image.e01

If it doesn't I would try to load it in Autopsy browser.

Maybe something wrong with the split??


   
ReplyQuote
(@twjolson)
Honorable Member
Joined: 17 years ago
Posts: 417
Topic starter  

No, indur had it right. For some reason -i ruins it, even though it shouldn't.

Told you I was missing something stupid…


   
ReplyQuote
Share: