File carving

[pgd1983]

Hello,

i am actually testing OSF with the good old Hacking-Case (which look good) and the "Emma Crook" Case (https://www.isfce.com/sample-pe.htm). I use the Demo of OSF 9.x and i find no way to carve files.

Is there really no option to do a RAW-recovery of files?

[David (PassMark)]

There are multiple ways. Best option depends on what data you already have.

Example below is file carving from the raw disk using a byte / sector offset.



But there are also options to automatically recovered deleted files from the "Deleted File Search" module.

[David (PassMark)]

There is also the PDF format OSForensics Users Guide here

[pgd1983]

Thanks I was aware of method 1 and manual carving would be not a big deal for that demo-case with 4 files in a 1,44MB floppy image to analyze but it's unpractically in a case where I have a multipe TB drive which was formated...

I was in the Deleted File Search but have overlooked the carving tickbox in the options - my bad . I where sure it was somewhere but could not remember where it was hidden. The last time I used OSF was with version 3

Carving is quite important in my opinion - maybe it would be better to place the "enable carving" - tickbox on the main-dialog that this option is easiert to spot. Just my 50 cent!

Thanks for the fast replay. Have a nice day...