.

Carving tools

<<

jimbob

Post Mon Aug 14, 2006 9:32 am

Carving tools

Hi,
I was looking at an example forensics exercise one the web...

http://www.certified-computer-examiner.com/cce-samp.htm

After doing all the usual things I surmised that I needed a tool to carve deleted MS Office document from the image. Not having much experience with carving tools I thought I'd throw this open to the good people here for suggestions and advice. Are there any good free/open source carvers out there?

Jim
<<

pcsneaker

Jr. Member
Jr. Member

Posts: 73

Joined: Mon Nov 07, 2005 12:23 pm

Post Mon Aug 14, 2006 9:58 am

Re: Carving tools

Foremost is an OpenSource Solution.
MCSA:Security (W2k, W2k3)
MCSE:Security (W2k, W2k3)
CPTS, Network+
<<

don

User avatar

Administrator
Administrator

Posts: 4226

Joined: Sun Aug 28, 2005 10:47 pm

Location: Chicago

Post Mon Aug 14, 2006 10:35 am

Re: Carving tools

Try these 2 as recommended by the Curriculum Developer for CCE:

DataLifter - Retail Product, Pricier
http://www.datalifter.com/

Simple Carver - Fast and Cheap
http://www.filesig.co.uk/simplecarver.html

Hope this helps,
Don
CISSP, MCSE, CSTA, Security+ SME
<<

jimbob

Post Tue Aug 15, 2006 4:27 am

Re: Carving tools

I tried foremost. It was a small source download, compiled cleanly under cygwin and worked first time to recover the files from the floppy image. Nice!

Jim

Return to Forensics

Who is online

Users browsing this forum: No registered users and 0 guests

.
Powered by phpBB® Forum Software © phpBB Group.
Designed by ST Software