Computer Forensics Tools & Techniques Catalog
Forensic Functionality:File Carving
Description:Searching for and reconstructing files based on content, rather than file system metadata. See, "The Evolution of File Carving" Pal and Memon and "Carving contiguous and fragmented files with fast object validation" Garfinkel for more information.
Technical Parameters: Tool host OS / runtime environment Supported file types Custom file types Carving boundaries Supported file carving methods File viewer/file preview
Windows graphics (e.g., jpg, png, bmp, gif) support for adding/defining custom file types support for carving on byte boundaries support for header/footer-based carving - carving files using a distinct header and footer integrated file viewer/file preview
Linux audio (e.g., mp3, wav, au, wma) custom file types not supported support for carving on sector boundaries support for header/maximum size carving - carving files using a distinct header and maximum file size no integrated file preview/file viewer
Mac video (e.g., mp4, avi, mov, flv) support for carving on cluster boundaries support for file structure-based carving - carving files using a certain level of knowledge of the internal structure of file types
documents (e.g., doc, xls, ppt, pdf) support for carving fragmented files - two or more fragments are reassembled to form the original file
archives (e.g., 7z, bz2, zip, tar) support for carving with file type validation - carved files are validated using a file type specific validator
MIME (e.g., EML, Mbox)