Difference between revisions of "File Carving"

From ForensicsWiki
Jump to: navigation, search
m
m
Line 1: Line 1:
'''File carving''' is the practice of searching an input for files based on their headers and/or footers. Most often the input is a [[disk image]], but it's possible (and sometimes practical) to carve individual files or [[physical memory]].
+
'''File carving''' is the practice of searching an input for files based on the input's content. Most often the input is a [[disk image]], but it's possible (and sometimes practical) to carve individual files or [[physical memory]].
  
Many carving programs have an option to only look at or near sector boundaries where headers are found. Searching the entire input can find files that have been embedded into other formats, such as [[JPEG]]s being embedded into [[Microsoft]] [[DOC|Word documents]] or files stored in a [[ZIP]] archive.
+
Most file carvers operate by looking for file headers and/or footers, and then "carving out" the blocks between these two boundaries. [[Semantic Carving]] performs carving based on an analysis of the contents of the proposed files.
 +
 
 +
Many carving programs have an option to only look at or near sector boundaries where headers are found. Searching the entire input can find files that have been embedded into other formats, such as [[JPEG]]s being embedded into [[Microsoft]] [[DOC|Word documents]].

Revision as of 15:53, 12 June 2006

File carving is the practice of searching an input for files based on the input's content. Most often the input is a disk image, but it's possible (and sometimes practical) to carve individual files or physical memory.

Most file carvers operate by looking for file headers and/or footers, and then "carving out" the blocks between these two boundaries. Semantic Carving performs carving based on an analysis of the contents of the proposed files.

Many carving programs have an option to only look at or near sector boundaries where headers are found. Searching the entire input can find files that have been embedded into other formats, such as JPEGs being embedded into Microsoft Word documents.