Before we start, it's important to note that PhotoRec supports disk images: not only RAW, but also E01. As we are carving data for forensic purposes, let's use an E01 image that we acquired in one of the previous recipes.
- Start the Windows Command Prompt from an account in the Administrator group, and change the directory to testdisk-7.0. Use the following command:
- Make sure you typed the path to the image you acquired, as it can have a different name and location.
- The first dialog box that you see is 'Select a media'. In our case we are dealing with an E01 image, so we have only one option, and all we need to do is press Enter to proceed.
- Now we ...