Issue Carving Files from Disk Image

[klighty]

Hello, I'm encountering a somewhat frequent issue when attempting to run brunnhilde on disk images, where Brunhilde/tsk_recover are unable to carve files from disk images. I've confirmed that these are file systems that tsk_recover says it supports (one ISO9660 and one FAT32 image each so far). Unsure if this is just an issue with tsk_recover, but thought it would worth mentioning the issue here. Have been successful with several other images with the same file systems.

[tw4l]

Thank you for your patience! This message got a bit lost in my inbox. I can confirm I've had similar issues, and that this is an issue with tsk_recover. You could try opening an issue in the sleuthkit repository, particularly if you can identify patterns to when tsk_recover fails to work. I opened one about dual-formatted ISO9660/HFS+ disks almost 6 months ago that has yet to get a reply.

In the meantime I'm going to keep this issue open as a reminder to come back and give handling of disk images some more thought when I have a bit of time to work on Brunnhilde.