Running on VMDK / E01 images

harelsegev / INDXRipper

Carve file metadata from NTFS index ($I30) attributes

MIT License

60 stars 5 forks source link

Running on VMDK / E01 images #7

Closed kartone closed 2 years ago

kartone commented 2 years ago

Other than RAW images, what kind of images (E01/VMDK) are supported? Thanks!

harelsegev commented 2 years ago

Only .raw images are supported. Mount your .vmdk / .e01images using Arsenal Image Mounter, and then run INDXRipper. ewfmount is also a great option for .e01, if you use Linux.

I don't plan on supporting other image formats. Is there a specific reason mounting is not an option for you?

kartone commented 2 years ago

I receive this error with the image mounted via Arsenal

harelsegev commented 2 years ago

You should use the device path of the drive.

Try this: INDXRipper.exe \\.\J: outfile_1.csv

kartone commented 2 years ago

Thanks!