Alternative to Disk Image Access for deleted files?

[Joshua V]

I am encountering an error with Disk Image Access where it will not export the contents of my image file. I select the image, the file directory loads and I'm able to select what files I want exported, but when I click "Export Selections", nothing happens. Is there another tool I can use to access the deleted files in my image file?

Sorry if the wording to this is wrong. I'm fairly new to all this.

[Kam Woods]

The DIA tool displays file system entry metadata that is discovered by TSK, whether or not the underlying file data still exists. If you click export selections and nothing happens, it usually means that TSK couldn't find any file data to recover.

On the other hand, you could have run into a bug. The DIA tool has not been updated in some time. You could try parsing the image content directly using other command line tools (see https://therootuser.com/2017/11/13/recover-deleted-files-using-sleuthkit/ as an example, although there are many guides out there), or load the same image into FTK imager on a Windows machine and see what it shows. If FTK Imager is able to recover the files but the DIA is not, you could file a bug report for the DIA at https;//github.com/bitcurator/bitcurator-distro-tools.

Kam

On Wed, Feb 12, 2020 at 5:10 PM Joshua V <drpuffs...@gmail.com> wrote:

I am encountering an error with Disk Image Access where it will not export the contents of my image file. I select the image, the file directory loads and I'm able to select what files I want exported, but when I click "Export Selections", nothing happens. Is there another tool I can use to access the deleted files in my image file?

Sorry if the wording to this is wrong. I'm fairly new to all this.

--
You received this message because you are subscribed to the Google Groups "BitCurator Users" group.
To unsubscribe from this group and stop receiving emails from it, send an email to bitcurator-use...@googlegroups.com.
To view this discussion on the web visit https://groups.google.com/d/msgid/bitcurator-users/587e6c5c-b231-4814-89f9-88a5ea3d89a2%40googlegroups.com.

[Joshua V]

Thank you, Kam. I was able to export the contents of my image file using FTK Imager, though it doesn't retain the original "file created date" like Disk Image Access does. I will put in a bug report with DIA.

On Wednesday, February 12, 2020 at 4:34:05 PM UTC-6, Kam Woods wrote:

The DIA tool displays file system entry metadata that is discovered by TSK, whether or not the underlying file data still exists. If you click export selections and nothing happens, it usually means that TSK couldn't find any file data to recover.

On the other hand, you could have run into a bug. The DIA tool has not been updated in some time. You could try parsing the image content directly using other command line tools (see https://therootuser.com/2017/11/13/recover-deleted-files-using-sleuthkit/ as an example, although there are many guides out there), or load the same image into FTK imager on a Windows machine and see what it shows. If FTK Imager is able to recover the files but the DIA is not, you could file a bug report for the DIA at https;//github.com/bitcurator/bitcurator-distro-tools.

Kam

On Wed, Feb 12, 2020 at 5:10 PM Joshua V <drpuffs...@gmail.com> wrote:

I am encountering an error with Disk Image Access where it will not export the contents of my image file. I select the image, the file directory loads and I'm able to select what files I want exported, but when I click "Export Selections", nothing happens. Is there another tool I can use to access the deleted files in my image file?

Sorry if the wording to this is wrong. I'm fairly new to all this.

--
You received this message because you are subscribed to the Google Groups "BitCurator Users" group.

To unsubscribe from this group and stop receiving emails from it, send an email to bitcurat...@googlegroups.com.