±Forensic Focus Partners

Become an advertising partner

±Your Account


Username
Password

Forgotten password/username?

Site Members:

New Today: 0 Overall: 36763
New Yesterday: 2 Visitors: 128

±Follow Forensic Focus

Forensic Focus Facebook PageForensic Focus on TwitterForensic Focus LinkedIn GroupForensic Focus YouTube Channel

RSS feeds: News Forums Articles

±Latest Articles

±Latest Videos

±Latest Jobs

file recovery with foremost

Forensic software discussion (commercial and open source/freeware). Strictly no advertising.
Reply to topicReply to topic Printer Friendly Page
Forum FAQSearchView unanswered posts
Page 1, 2  Next 
  

Ibernato
Member
 

file recovery with foremost

Post Posted: Sep 24, 19 12:00

Hello to all,
I'm using the foremost tool to keep files from a vmdk file. (It is an experiment for my thesis work). The problem is that the tool also retrieves the default windows 10 images. Is there a way to prevent wondows 10 default images from appearing?  
 
  

keydet89
Senior Member
 

Re: file recovery with foremost

Post Posted: Sep 24, 19 13:12

Have you tried modifying the configuration file?  
 
  

Ibernato
Member
 

Re: file recovery with foremost

Post Posted: Sep 24, 19 16:31

- keydet89
Have you tried modifying the configuration file?

No, i'm new with this tool.
Can you help me?

Another question.
I am currently using a vmdk file. Is it correct or should I first convert it to raw?  
 
  

keydet89
Senior Member
 

Re: file recovery with foremost

Post Posted: Sep 24, 19 19:24

 
  

Ibernato
Member
 

Re: file recovery with foremost

Post Posted: Sep 25, 19 13:09

- keydet89
https://www.systutorials.com/docs/linux/man/8-foremost/

wiki.archlinux.org/ind...p/Foremost


Thanks, but not work....

Is it good practice to analyze the vmdk file directly? Or is it better to convert it to a raw format?  
 
  

jaclaz
Senior Member
 

Re: file recovery with foremost

Post Posted: Sep 25, 19 13:37

- Ibernato

Is it good practice to analyze the vmdk file directly? Or is it better to convert it to a raw format?

Ok, you actually asked for it.

The answer is "it depends".

It depends on which specific (among the zillion available ones) format of vmdk is used and how (exactly) the image is created and populated.

Here is an overview of vmdk formats, some are EXACTLY the same as a RAW image, some are very unlike it:
sanbarrow.com/vmdk-handbook.html
sanbarrow.com/vmdk-bas...rseandflat

See also:

github.com/libyal/libv...).asciidoc

About your original question:
- Ibernato
Hello to all,
I'm using the foremost tool to keep files from a vmdk file. (It is an experiment for my thesis work). The problem is that the tool also retrieves the default windows 10 images. Is there a way to prevent wondows 10 default images from appearing?


I cannot understand it, can you try better explaining what is the issue at hand?

What do you mean by "keep files"?
What do you mean by "default windows 10 images"?
Do you mean the pictures (image files such as .png, .bmp and .jpg) that are included in a "default" Windows 10 install?

jaclaz
_________________
- In theory there is no difference between theory and practice, but in practice there is. - 
 
  

Ibernato
Member
 

Re: file recovery with foremost

Post Posted: Sep 25, 19 21:47

- jaclaz
- Ibernato

Is it good practice to analyze the vmdk file directly? Or is it better to convert it to a raw format?

Ok, you actually asked for it.

The answer is "it depends".

It depends on which specific (among the zillion available ones) format of vmdk is used and how (exactly) the image is created and populated.

Here is an overview of vmdk formats, some are EXACTLY the same as a RAW image, some are very unlike it:
sanbarrow.com/vmdk-handbook.html
sanbarrow.com/vmdk-bas...rseandflat

See also:

github.com/libyal/libv...).asciidoc


I cannot understand it, can you try better explaining what is the issue at hand?

What do you mean by "keep files"?
What do you mean by "default windows 10 images"?
Do you mean the pictures (image files such as .png, .bmp and .jpg) that are included in a "default" Windows 10 install?

jaclaz


Yes, default image included in Windows 10 install.  
 

Page 1 of 2
Page 1, 2  Next