tsk_recover
tsk_recover ./RAW-ImageDrive.dd ./tsk_recover/foremost
foremost -i RAW-ImageDrive.dd -o ./foremost/autopsy
Java sucks. Better run it on Windows. Just open it and you can operate it intuitively. It’s GUI, tho
ftkimager
Better run it on Windows. Just open it and you can operate it intuitively. It’s GUI, tho
dmde
Can run on Linux. Same as autopsy, just open it and you can operate it intuitively. It’s GUI, tho