getprevcon_raw - Linux


getprevcon_raw retrieves the previous console number from the raw (binary) disk image file. This command is primarily used in forensic investigations to recover data from damaged or deleted partitions by accessing raw disk images.


getprevcon_raw [-m|--milestone-name <milestone>]


| Option | Description | Default |
| -m, –milestone-name | The milestone name to analyze. By default, analyzes the first milestone found in the disk image. | N/A |


  • Retrieve the previous console number from a raw disk image with the first milestone:
  • Retrieve the previous console number from a specific milestone:
getprevcon_raw --milestone-name milestone4

Common Issues

  • Invalid milestone name: If the specified milestone name does not exist, the command will fail. Ensure the provided milestone name is correct.


getprevcon_raw can be integrated into forensic scripts or command chains to automate data recovery processes. For example, it can be used within a script that extracts console logs from a raw disk image.

Related Commands

  • fdisk – Manipulate partition tables.
  • dd – Convert and copy files.
  • foremost – Recover files from damaged media.