File forencisc of USB
make image out of USB stick:
dd if=/dev/hda (DEVICE) of=mybigfile.img bs=(disc cache size, eg 8M) conv=noerror,sync status=progress
u can recognize it with dmesg
usually /dev/sdb1, NOT /media/user/usb…
Autopsy: choose volume drive if needed
Exoprt file -> will be exported to downloads folder
free hexa editor pro analýzu a cracking binárních souborů, umí definovat gramatiku. Pro Windows a Linux
https://hexinator.com
