tsk_recover -VERSION (return code: 0)
The Sleuth Kit ver 4.4.2
tsk_recover (return code: 1)
Missing output directory and/or image name
usage: tsk_recover [-vVae] [-f fstype] [-i imgtype] [-b dev_sector_size] [-o sector_offset] [-d dir_inum] image [image] output_dir
-i imgtype: The format of the image file (use '-i list' for supported types)
-b dev_sector_size: The size (in bytes) of the device sectors
-f fstype: The file system type (use '-f list' for supported types)
-v: verbose output to stderr
-V: Print version
-a: Recover allocated files only
-e: Recover all files (allocated and unallocated)
-o sector_offset: sector offset for a volume to recover (recovers only that volume)
-d dir_inum: Directory inum to recover from (must also specify a specific partition using -o or there must not be a volume system)