Using image_export

Kristinn Gudjonsson edited this page Jul 28, 2015 · 5 revisions
Clone this wiki locally

PAGE WIP

image_export is a command line tool to export file content from a storage media image or device based on various filter criteria, such as extension names, filter paths, file format signature identifiers, file creation date and time ranges, etc.

Usage

To get a full list of parameters that can be passed to the tool use the -h or --help switch.

There are several ways to define how you want to find the files to extract:

  • Based on path, filename or extension name
  • Based on time range
  • Based on format signature

Path, filename or extension

discuss here:

--names NAMES
-f FILE_FILTER

collection filters

-x EXTENSIONS, --extensions EXTENSIONS

Time range

--date-filter TYPE_START_END, --date_filter TYPE_START_END

Format signature

--signatures IDENTIFIERS

Other options

Talk about: --data -w PATH

--include_duplicates

--no_vss --vss_stores VSS_STORES