• Home
• Search
• Taxonomy
• Developers
• Contacts

Searching for forensic tools and techniques by

functionality

Find all File Carving tools and techniques    Refine by search parameters

Forensic Functionality:	File Carving
Description:	Searching for and reconstructing files based on content, rather than file system metadata. See http://www.forensicswiki.org/wiki/File_Carving, "The Evolution of File Carving" http://digital-assembly.com/technology/research/pubs/ieee-spm-2009.pdf Pal and Memon and "Carving contiguous and fragmented files with fast object validation" dfrws.org/2007/proceedings/p2-garfinkel.pdf Garfinkel for more information.
Technical Parameters:	Tool host OS / runtime environment:	Supported file types:	Custom file types:	Carving boundaries:	Supported file carving methods:	File viewer/file preview:
	any N/A Windows Linux Mac	any N/A graphics (e.g., jpg, png, bmp, gif) audio (e.g., mp3, wav, au, wma) video (e.g., mp4, avi, mov, flv) documents (e.g., doc, xls, ppt, pdf) archives (e.g., 7z, bz2, zip, tar) MIME (e.g., EML, Mbox)	any Support for adding/defining custom file types Support for adding/defining custom file types Custom file types not supported	any N/A Support for carving on byte boundaries Support for carving on sector boundaries Support for carving on cluster boundaries	any N/A Support for header/footer-based carving - carving files using a distinct header and footer Support for header/maximum size carving - carving files using a distinct header and maximum file size Support for file structure-based carving - carving files using a certain level of knowledge of the internal structure of file types Support for carving fragmented files - two or more fragments are reassembled to form the original file Support for carving with file type validation - carved files are validated using a file type specific validator	any N/A Integrated file viewer/file preview No integrated file preview/file viewer