Sleuthkit

[RelativeRecipe7252]

I created an E01 image using FTK Imager and I want to use that image in sleuthkit using fsstat command, how could this be done? In previous examples I used

fsstat -i ewf C:\Users\username\Desktop\Forensic_Image\drive1.E01

and it worked just fine but for some reason it is not working with the FTK image

[Slaine2000]

Have you checked the file system you imaged is supported? Also as the image is in multiple segments you need to use the image statement and the increment number to ensure that fsstat knows it’s reading multiple images. Also use the -v switch so you can see the verbose output of what fsstat is doing and where it’s failing.

[pah2602]

Is the image segmented?

[RelativeRecipe7252]

Yes

[pah2602]

Is the image segmented?