Thanks I was aware of method 1 and manual carving would be not a big deal for that demo-case with 4 files in a 1,44MB floppy image to analyze but it's unpractically in a case where I have a multipe TB drive which was formated...
I was in the Deleted File Search but have overlooked the carving tickbox in the options - my bad . I where sure it was somewhere but could not remember where it was hidden. The last time I used OSF was with version 3
Carving is quite important in my opinion - maybe it would be better to place the "enable carving" - tickbox on the main-dialog that this option is easiert to spot. Just my 50 cent!
Thanks for the fast replay. Have a nice day...
Announcement
Collapse
No announcement yet.
File carving
Collapse
X
-
There are multiple ways. Best option depends on what data you already have.
Example below is file carving from the raw disk using a byte / sector offset.
But there are also options to automatically recovered deleted files from the "Deleted File Search" module.
Leave a comment:
-
File carving
Hello,
i am actually testing OSF with the good old Hacking-Case (which look good) and the "Emma Crook" Case (https://www.isfce.com/sample-pe.htm). I use the Demo of OSF 9.x and i find no way to carve files.
Is there really no option to do a RAW-recovery of files?Tags: None
Leave a comment: