transferContent: include review of mmls output to determine appropriate partition for file replication
Closed this issue · 0 comments
shallcro commented
'transferContent' workflow step includes a extraction/replication of files from a disk image.
In cases where mmls has produced output (i.e., documentation of partitions), there should be a check.
tsk_recover command will need to include -o option (sector offset for start of partition)
Note that more than one partition with files may be present.