1  cp /dev/null .bash_history
    2  sync
    3  halt
    4  cd /mnt/hgfs/for
    5  cd /mnt/hgfs/FOR
    6  ls
    7  file Image-1.raw
    8  pwd
    9  mkdir /mnt/forensic1
   10  mkdir /mnt/forensic2
   11  mmls Image-1.raw
   12  mount -o ro,loop,offset=525336576 Image-1.raw /mnt/forensic1
   13  cd /mnt/forensic1
   14  l
   15  ls
   16  cd $Recycle.Bin
   17  ls
   18  cd PerfLogs/
   19  ls
   20  ls -lah
   21  cd ..
   22  ls
   23  ls > grep cycle
   24  cd ..
   25  ls
   26  fls -f ntfs /mnt/forensic1
   27  ls
   28  cd forensic1
   29  ls
   30*
   31  ls
   32  mount -o ro,loop,offset=525336576 Image-1.raw /dev/loop1
   33  cd ..
   34  ls
   35  cd hgfs/
   36  ls
   37  cd FOR
   38  ls
   39*
   40  fls -f ntfs /dev/loop1
   41  ntfsundelete /dev/loop1
   42  ntfsundelete /dev/loop1 -u
   43  file Image-1.raw
   44  mmls Image-1.raw
   45  sigfind -o 512 -l AA55 Image-1.raw
   46  sigfind -o 510 -l AA55 Image-1.raw
   47  dd if=Image-1.raw skip=1026048 count=1 > xxd
   48  dd if=Image-1.raw skip=1026048 count=1 | xxd
   49  ls /dev/loop0
   50  cd /mnt/forensic1
   51  ls
   52  cd Recovery/
   53  ls
   54  ls -lah
   55  cd ..
   56  ls -lah
   57  history
   58  fls -l -d -f ntfs -o 1026048 /dev/loop0
   59  fls -l -d -f ntfs -o 1026048 /dev/loop1
   60  fls -l -d -f ntfs -o 1026048 /dev/loop0
   61  cd /dev
   62  ls
   63  fls -f ntfs -o 1026048 /dev/loop0
   64  fls -f ntfs -o 1026048 /dev/loop1
   65  cd /tmp
   66  ls
   67  cd /mnt
   68  ls
   69  cd hgfs
   70  ls
   71  cd FOR
   72  ls
   73  mount -o ro,loop,offset=525336576 Image-1.raw /dev/loop1
   74  mount -o ro,loop,offset=525336576 Image-1.raw /dev/loop2
   75  fls -f ntfs -o 1026048 /dev/loop2
   76  mount -o ro,loop,offset=525336576 Image-1.raw /dev/loop0
   77  fls -f ntfs -o 1026048 /dev/loop0
   78  fls -f ntfs -o 1026048 /dev/loop1
   79  umount -f /dev/loop1
   80  umount -f /dev/loop2
   81  umount -f /dev/loop0
   82  mount -o ro,loop,offset=525336576 Image-1.raw /dev/loop0
   83  umount -f /dev/loop1
   84  umount -f /dev/loop2
   85  umount -f /dev/loop0
   86  mount -o ro,loop,offset=525336576 Image-1.raw /dev/loop0
   87  fls -f ntfs -o 1026048 /dev/loop0
   88  umount -f /dev/loop1
   89  umount -f /dev/loop2
   90  umount -f /dev/loop0
   91  fls -f ntfs -o 1026048 /dev/loop0
   92  mount -o ro,loop,offset=525336576 Image-1.raw /dev/loop0
   93  fls -f ntfs -o 1026048 /dev/loop0
   94  umount -f /dev/loop0
   95  umount -f /dev/loop1
   96  umount -f /dev/loop2
   97  losetup /dev/loop0 Image-1.raw
   98  fdisk -l /dev/loop0
   99  fls -f ntfs -o 1026048 /dev/loop0
  100  fls -d -r  -f ntfs -o 1026048 /dev/loop0
  101  fls -d -r -l  -f ntfs -o 1026048 /dev/loop0
  102  fls -D  -r -l  -f ntfs -o 1026048 /dev/loop0
  103  fls -D  -f ntfs -o 1026048 /dev/loop0
  104  fls -D -d -f ntfs -o 1026048 /dev/loop0
  105  man fls
  106  umount -f /dev/loop2
  107  umount /dev/loop2
  108  umount /dev/loop1
  109* mount -o ro,loop,offset= Image-1.raw /dev/loop0
  110  history
  111  mmls Image-1.raw
  112  umount /dev/loop1
  113  umount /dev/loop2
  114  umount /dev/loop0
  115  history
  116  umount /dev/loop2
  117  umount /dev/loop1
  118  umount /dev/loop0
  119  mount -o ro,loop,offset=1048576 Image-1.raw /dev/loop0
  120  ls /dev/loop0
  121  ls /dev/loop1
  122  ls /dev/loop2
  123  mount -o -t ntfs ro,loop,offset=1048576 Image-1.raw /mnt/forensic2
  124  mount -t ntfs -o ro,loop,offset=1048576 Image-1.raw /mnt/forensic2
  125  cd /mnt/forensic2
  126  ls
  127  history
  128  fls -f ntfs -o 1026048 /mnt/hgfs/FOR/Image-1.raw
  129  history