SANS Digital Forensics and Incident Response Blog: Tag - carving

Making Reviewing Files From Data Carving Easier: Documents

This is my second installment on dealing with files recovered through the use of data carving tools. As I said in my previous post on data carving, that having to do corporate forensics, I end up having mountains of files to go through after running data carvers like Foremost/Scalpel or Photorec. Most of the programs out there either can't handle the amount of files or are very time consuming to work with. One of the worst ones to go through was document files. You know the


Making Reviewing Files From Data Carving Easier: Images


I usually do a lot of data carving. With 500 gig drives becoming the norm in machines, the recovered files I see from data carving is huge. Nothing like having to review 10000+ jpegs and having to review each one. I had a lot of issues trying to find something to review that many images. After trying many programs and some hacks to break up the images into smaller subsets. I decided to write my own set of tools for processing the files recovered from data carving.

Data Carver Processors

The Data Carver Processors are a combination of Perl scripts and other programs that are designed to break up the recovered files into manageable chunks. As the script runs over the files, it will create a series of web pages with thumbnails and a second web page for each file that contains plug-in output like metadata, hashes, and etc. The scripts, for the most part, will not process damaged files. If a file is damaged, there will be no image for it on

... Continue reading Making Reviewing Files From Data Carving Easier: Images