table of contents
other versions
- wheezy 3.2.3-2
- wheezy-backports 4.1.3-3~bpo70+1
- jessie 4.1.3-4
- testing 4.4.0-5
- unstable 4.4.0-5
TSK_RECOVER(1) | General Commands Manual | TSK_RECOVER(1) |
NAME¶
tsk_recover - Export files from an image into a local directorySYNOPSIS¶
tsk_recover [-vVae] [-i imgtype ] [-b dev_sector_size ] [-o sector_offset ] [-d dir_inum ] image output_dirDESCRIPTION¶
tsk_recover recover files to the output_dir from the image. By default recovers only unallocated files. With flags, it will export all files.- -v
- verbose output to stderr
- -V
- Print version
- -a
- Recover allocated files only
- -e
- Recover all files (allocated and unallocated)
- -i imgtype
- The format of the image file (use '-i list' for supported types) If not given, autodetection methods are used.
- -b dev_sector_size
- The size (in bytes) of the device sectors If not given, autodetection methods are used.
- -o sector_offset
- Sector offset for a volume to recover (recovers only that volume) If not given, will attempt to recover all volumes in image and save them to different folders.
- -d dir_inum
- Directory inum to recover from (must also specify a
specific partition using -o or there must not be a volume system)