how to acquire disk images like(/dev/sda) on windows,or can it work?

Velocidex / c-aff4

An AFF4 C++ implementation.

http://docs.aff4.org

Apache License 2.0

186 stars 35 forks source link

how to acquire disk images like(/dev/sda) on windows,or can it work? #139

Open MarcusXe opened 4 years ago

MarcusXe commented 4 years ago

E:>aff4imager.exe -dd -o E:\output.aff4 -i /dev/sde --format raw --volume_format raw 2020-03-27 13:28:35 I This is The WinPmem memory imager. version 3.3rc2 2020-03-27 13:28:35 I Output volume is not an AFF4 file. Cannot capture additional streams. Choose an AFF4 volume to capture additional streams.

scudette commented 4 years ago

You should allow the output volume to be aff4 to write multiple streams. On windows raw devices are of the form \.\C: