Fragmented E01 #1683
-
Hello, I've a fragmented 10TB image (size 200GB). iped.exe -d j:Disco001.E01 -o D:\Caparelli\SP198-2023\Dados-Processados-IPED-Disco001 --portable -profile forensic Occour that the IPED ignored the others files and processed just the first one (001). |
Beta Was this translation helpful? Give feedback.
Replies: 2 comments 1 reply
-
The normal behavior is processing all of them, but just the first fragment is shown into the case. If the file system was decoded correctly, you can be confident the other segments were processed fine. You can also check the partitions size in the Evidence tree tab. |
Beta Was this translation helpful? Give feedback.
-
considering the doubt arising from the timestamp of the parts, you can check the integrity of the image usign ftk imager |
Beta Was this translation helpful? Give feedback.
considering the doubt arising from the timestamp of the parts, you can check the integrity of the image usign ftk imager