Ethical Hacker Community Forums

Ethical Hacking Discussions and Related Certifications => Forensics => Topic started by: jimbob on August 14, 2006, 09:32:34 AM

Title: Carving tools
Post by: jimbob on August 14, 2006, 09:32:34 AM

Hi,
I was looking at an example forensics exercise one the web...

http://www.certified-computer-examiner.com/cce-samp.htm

After doing all the usual things I surmised that I needed a tool to carve deleted MS Office document from the image. Not having much experience with carving tools I thought I'd throw this open to the good people here for suggestions and advice. Are there any good free/open source carvers out there?

Jim

Title: Re: Carving tools
Post by: pcsneaker on August 14, 2006, 09:58:49 AM

Foremost (http://foremost.sourceforge.net/) is an OpenSource Solution.

Title: Re: Carving tools
Post by: don on August 14, 2006, 10:35:27 AM

Try these 2 as recommended by the Curriculum Developer for CCE:

DataLifter - Retail Product, Pricier
http://www.datalifter.com/

Simple Carver - Fast and Cheap
http://www.filesig.co.uk/simplecarver.html

Hope this helps,
Don

Title: Re: Carving tools
Post by: jimbob on August 15, 2006, 04:27:29 AM

I tried foremost. It was a small source download, compiled cleanly under cygwin and worked first time to recover the files from the floppy image. Nice!

Jim