TSK_RECOVER(1)

NAME
tsk_recover - Export files from an image into a local directory

SYNOPSIS
tsk_recover [-vVae] [-i imgtype ] [-b dev_sector_size ] [-o sector_offset ] output_dir image

DESCRIPTION
tsk_recover recover files to the output_dir from the image. By default recovers only unallocated files. With flags, it will export all files. The arguments are as follows:

-v  verbose output to stderr

-V  Print version

-a  Recover allocated files only

-e  Recover all files (allocated and unallocated)

-i imgtype
    The format of the image file (use '-i list' for supported types) If not given, autodetection methods are used.

-b dev_sector_size
    The size (in bytes) of the device sectors If not given, autodetection methods are used.

-o sector_offset
    Sector offset for a volume to recover (recovers only that volume) If not given, will attempt to recover all volumes in image and save them to different folders.

EXAMPLES
To recover only unallocated files from image.dd to the recovered directory:
    # tsk_recover ./recovered ./image.dd

AUTHOR
Brian Carrier <carrier at sleuthkit dot org> Send documentation updates to <doc-updates at sleuthkit dot org>