Scripted on E01 with mutli partitions
Posted: 19 Oct 2012, 21:58
Thank you for this wonderful piece of software.
I have to recover deleted files on numerous E01 images.
My current one I am working with has 4 partitions. A HFS+, NTFS, EXT4 and a Fat32.
I have found that I need to first mount the E01 Image using ewfmount. I then pass it the ewf1 file that got mounted. I have not been able to get it running on just the E01. This is ok.
I would like to have your tool automatically run through each partition found on the evidence file. Right now I either have to know the partition name or just settle with it only running on the first partition. Due to the fact I will be encountering E01s containing random partition types, this will not work.
Do you have a recommendation?
XUbuntu Linux
Scripts written in python3.2
Thanks!
I have to recover deleted files on numerous E01 images.
My current one I am working with has 4 partitions. A HFS+, NTFS, EXT4 and a Fat32.
I have found that I need to first mount the E01 Image using ewfmount. I then pass it the ewf1 file that got mounted. I have not been able to get it running on just the E01. This is ok.
I would like to have your tool automatically run through each partition found on the evidence file. Right now I either have to know the partition name or just settle with it only running on the first partition. Due to the fact I will be encountering E01s containing random partition types, this will not work.
Do you have a recommendation?
XUbuntu Linux
Scripts written in python3.2
Thanks!