File: Using-image_export.md

package info (click to toggle)
plaso 20190131-1
  • links: PTS, VCS
  • area: main
  • in suites: buster
  • size: 410,832 kB
  • sloc: python: 76,636; sh: 926; makefile: 167; xml: 70; sql: 14; vhdl: 11
file content (50 lines) | stat: -rw-r--r-- 987 bytes parent folder | download
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
# Using image_export.py

**PAGE WIP**

**image_export** is a command line tool to export file content from a storage media image or device based on various filter criteria, such as extension names, filter paths, file format signature identifiers, file creation date and time ranges, etc.

## Usage

To get a full list of parameters that can be passed to the tool use the ``-h`` or ``--help`` switch.

There are several ways to define how you want to find the files to extract:
 + Based on path, filename or extension name
 + Based on time range
 + Based on format signature

### Path, filename or extension

discuss here:

```
--names NAMES
```

```
-f FILE_FILTER
```
[collection filters](Collection-Filters.md)

```
-x EXTENSIONS, --extensions EXTENSIONS
```

## Time range

--date-filter TYPE_START_END, --date_filter TYPE_START_END

## Format signature

 --signatures IDENTIFIERS

## Other options

Talk about:
--data 
-w PATH

--include_duplicates

--no_vss
--vss_stores VSS_STORES