TSK_RECOVER(1)

💖 tsk_recover — the TSK_RECOVER(1) glow-up 💖

okay bestie, buckle up, because we're about to talk about tsk_recover from the General Commands Manual, section 1, and honestly? it's giving file rescue main character energy. ✨

---

✨ NAME ✨

tsk_recover — export files from an image into a local directory 🫶

---

🌸 SYNOPSIS 🌸

tsk_recover [-vVae] [ -f fstype ] [ -i imgtype ] [ -b dev_sector_size ]
[ -o sector_offset ] [ -d dir_inum ] image [images] output_dir

---

💅 DESCRIPTION 💅

so like, tsk_recover recovers files into the output_dir from the image. that's the whole vibe. 🎀

and here's the little plot twist: by default it recovers only unallocated files. yep, only the deleted/ghost ones. if you want everything, you gotta use flags. no cap. 👑

The arguments are as follows:

• -v — verbose output to stderr 🗣️ (she's chatty, she tells you things)
• -V — print version ⭐ (identity check, love that for her)
• -a — recover allocated files only 🟢
• -e — recover all files (allocated and unallocated) 🔥 the full scoop, the whole buffet
• -f fstype — specify the file system type. use -f list to list the supported file system types. if it's not given, autodetection methods are used 🔍 (she'll figure it out herself, she's smart)
• -i imgtype — the format of the image file, such as raw. use -i list to list the supported types. if not given, autodetection methods are used 🦋
• -b dev_sector_size — the size (in bytes) of the device sectors. if not given, autodetection methods are used 📏
• -o sector_offset — sector offset for a volume to recover (recovers only that volume). if not given, will attempt to recover all volumes in the image and save them to different folders 🗂️ (so many folders, so organized)
• -d dir_inum — directory inum to recover from (must also specify a specific partition using -o or there must not be a volume system) ⚠️ like, you can't just wander in there without directions, bestie
• image [images] — the disk or partition image to read, whose format is given with -i. multiple image file names can be given if the image is split into multiple segments. if only one image file is given, and its name is the first in a sequence (e.g., as indicated by ending in .001), subsequent image segments will be included automatically 🧩✨ (it just knows)
• output_dir — the directory in which to save recovered files 🎁

---

🌈 EXAMPLES 🌈

to recover only unallocated files from image.dd to the recovered directory:

# tsk_recover ./image.dd ./recovered

that's it. that's the whole ritual. iconic behavior fr fr 💜

---

👑 AUTHOR 👑

Brian Carrier <carrier at sleuthkit dot org> 💖

Send documentation updates to <doc-updates at sleuthkit dot org> 📬

---

reminder bestie: default = unallocated only. if you want the allocated files too, that's -e (or -a if you're being picky). don't come for me when you only get the deleted ones. 💀

---

and that's the tea 🍓 — this was TSK_RECOVER(1) from the General Commands Manual, section 1, signed off with all the love in the world. go recover something cute. mwah. 💅✨🎀