search

mnrkbys / vss_carver

Carves and recreates VSS catalog and store from Windows disk image.
MIT License
96 stars 21 forks source link

confusion in usage #2

Closed dinidininta closed 4 years ago

dinidininta commented 5 years ago

Sorry for posting this as an issue since i cannot find personal email of the developer. I am new in the whole system volume and shadow copies situation. Where can I find the value to fill the -o, -i, -c, and -s parameter in my computer?

Thank you very much in advance.

mnrkbys commented 4 years ago

You can use sleuthkit's mmls command to check number for -o. Other options are just file name. And, please learn about digital forensics. This tool is for digital forensics investigators and incident response handlers.

palaz1s commented 4 years ago

Hello @dinidininta

Hope you are well.

Were you able to figure this out? I'm in a similar situation.

Thank you!