Examining image files from inode

Problem completing one of the interactive tutorials?

Moderator: drgrussell

Post Reply
spencotom
Posts: 1
Joined: Tue Jul 21, 2015 1:17 pm
Are you a robot or a human?: Human

Examining image files from inode

Post by spencotom » Tue Jul 21, 2015 1:21 pm

On week 8 of the Caine tutorials, it asks me to examine the three deleted files which I have identified by examining their inode information. I am assuming I use the icat command for this, however I'm having difficulty getting any output from it.

I tried

icat -o 63 dimg2.dd 4 | xxd| more

and received an output. I'm not sure if this is the correct procedure as I'm having a little difficulty reading the output. Have I used the correct icat parameters and if so, could somebody help me understand it?

Thanks.

Post Reply

Who is online

Users browsing this forum: No registered users and 2 guests