I probably am missing something stupid and simple, but I can't figure this out. I have an E01 image, split into 650 mb chuncks.
I tried using the -i split option, along with <image>.E??, but sluethkit, mmls specifically, couldn't read the image.
I tried using -i ewf option, and it couldn't read it then either.
I even tried -i split,ewf, and mmls bawked at that, as I expected.
As a test, I tried a whole E01 image, and it read it just fine. So libewf is installed and working.
Anyone have an idea of how to do this?
Any help would be greatly appreciated
You shouldn't need any -i option, just to specify on the command line every image file in the correct order, e.g., mmls <image>.e*.
I would check the list of images parts you're passing to mmls with something like echo, e.g., echo <image>.e*.
This should work
# mmls -t dos -i ewf image.e01
If it doesn't I would try to load it in Autopsy browser.
Maybe something wrong with the split??
No, indur had it right. For some reason -i ruins it, even though it shouldn't.
Told you I was missing something stupid…