meta data for this page
  •  

This is an old revision of the document!

Windows Disk Image

  • Assumes basic setup from setup
  • All command below should be
    • copied to a “IR log” text/md file
    • edited as needed
    • executed with output copied back to “IR log”
      • recommendation: move commands/output from “useless commands” to second “IR dump” text/md file
pwd
WF=/case/working/folder
EF=/case/working/folder/evidence/evidence.E01
# EF1+.. additional variables for evidence files