No announcement yet.

File carving

  • Filter
  • Time
  • Show
Clear All
new posts

  • File carving


    i am actually testing OSF with the good old Hacking-Case (which look good) and the "Emma Crook" Case ( I use the Demo of OSF 9.x and i find no way to carve files.

    Is there really no option to do a RAW-recovery of files?

  • #2
    There are multiple ways. Best option depends on what data you already have.

    Example below is file carving from the raw disk using a byte / sector offset.

    File Carving raw disk OSForensics

    But there are also options to automatically recovered deleted files from the "Deleted File Search" module.

    File Carving Deleted Files OSForensics


    • #3
      There is also the PDF format OSForensics Users Guide here


      • #4
        Thanks I was aware of method 1 and manual carving would be not a big deal for that demo-case with 4 files in a 1,44MB floppy image to analyze but it's unpractically in a case where I have a multipe TB drive which was formated...

        I was in the Deleted File Search but have overlooked the carving tickbox in the options - my bad . I where sure it was somewhere but could not remember where it was hidden. The last time I used OSF was with version 3

        Carving is quite important in my opinion - maybe it would be better to place the "enable carving" - tickbox on the main-dialog that this option is easiert to spot. Just my 50 cent!

        Thanks for the fast replay. Have a nice day...