search

mnrkbys / vss_carver

Carves and recreates VSS catalog and store from Windows disk image.
MIT License
96 stars 21 forks source link

Vss_carver E01 Disktype #10

Closed Justthingsido closed 4 years ago

Justthingsido commented 4 years ago

When I run vss_carver with -t E01 it won't run and I get the following error. Any idea how I can fix this and make it work? I tested with RAW instead and it runs, but my file format is E01.

F:\Rec>vss_carver.py -t E01 -o 16777216 -i y:\EWF1 -c f:\data-catalog -s f:\data-store vss_carver 20200312 Traceback (most recent call last): File "F:\Rec\vss_carver.py", line 953, in <module> sys.exit(main()) File "F:\Rec\vss_carver.py", line 890, in main disk_filenames = pyewf.glob(args.image)' OSError: pyewf_glob: unable to glob filenames. libewf_glob_wide: invalid filename - missing extension.

mnrkbys commented 4 years ago

Did you mount an E01 file with ewfmount? EWF1 is a raw disk image. You should just specify E01 file. You do NOT need to mount it.