Media Image

From CGSecurity
Jump to: navigation, search

En.png English De.png Deutsch Es.png Español Fr.png Français It.png Italiano Ru.png Русский

Working with Hard Disk Image Files

TestDisk and PhotoRec can also work with hard disk images. The disk image must be available under its image_filename in the working directory, or you can add its path and filename to a TestDisk command line. For example:

testdisk_win.exe C:\BOCHS\DOS\c.img

will include the path and image file c.img in the list of drives on TestDisk's initial screen. Then open the image file just like any physical drive.

Image files are limited in size by the OS and filesystem.
2 GiB (FAT16), 4 GiB (FAT32), 16 GiB (ext2/3 with 1 kb block), 256 GiB (ext2/3 with 2 kb block), 2048 GiB (ext2/ext3 with 4 kb block)

Under Windows, you can select the image file in the File Explorer, use right-click, select 'Open With', choose photorec_win.exe to recover files from this image using PhotoRec.

Recover data from Encase EWF image

To analyse an image from an Encase E01 file:

testdisk image.E01

If the Encase image is split into several files:

testdisk 'image.E*'

Return to TestDisk