±Forensic Focus Partners

Become an advertising partner

±Your Account


Username
Password

Forgotten password/username?

Site Members:

New Today: 3 Overall: 35980
New Yesterday: 5 Visitors: 131

±Follow Forensic Focus

Forensic Focus Facebook PageForensic Focus on TwitterForensic Focus LinkedIn GroupForensic Focus YouTube Channel

RSS feeds: News Forums Articles

±Latest Articles

±Latest Videos

±Latest Jobs

File Headers for data carving

Computer forensics discussion. Please ensure that your post is not better suited to one of the forums below (if it is, please post it there instead!)
Reply to topicReply to topic Printer Friendly Page
Forum FAQSearchView unanswered posts
 
  

DaDataCop
Member
 

File Headers for data carving

Post Posted: Aug 26, 10 18:20

I was looking for file headers to try and carve out data from unallocated space on a drive where the suspect re-installed the OS (Vista HP 32-bit). I was able to find a lot of images using the JPG header and the keyword search has found web history data, but I'm looking for documents.

*.doc
*.wpd
*.txt
*.pdf
And any known headers for web based e-mail. Most likely AOL, Yahoo, Hotmail or Gmail.

TIA
Aron  
 
  

jaclaz
Senior Member
 

Re: File Headers for data carving

Post Posted: Aug 26, 10 18:36

- DaDataCop
I was looking ...


WHERE? Question

Or, in other words, is your Google broken? Shocked

Like:
msdn.microsoft.com/en-...e.12).aspx
www.adobe.com/devnet/p...rence.html
www.corelconnected.com...ucture.htm
(first results in a two minutes search)

- DaDataCop
*.txt

You sure you want a file header for .txt files? Rolling Eyes

jaclaz  
 
  

binarybod
Senior Member
 

Re: File Headers for data carving

Post Posted: Aug 26, 10 19:19

Have a look at www.garykessler.net/li..._sigs.html
alternatively in a *nix installation have a look at the magic file usually found in /usr/share/misc/magic

Paul  
 
  

armresl
Senior Member
 

Re: File Headers for data carving

Post Posted: Aug 26, 10 19:52

Seriously makes you wonder about the rest of the investigation, when something this basic is asked.

I concur with the WHERE statement.
Also agree with Binary Bod FIRST hit,
www.garykessler.net/li..._sigs.html
_________________
Why order a taco when you can ask it politely?

Alan B. "A man can live a good life, be honorable, give to charity, but in the end, the number of people who come to his funeral is generally dependent on the weather. " 
 
  

DaDataCop
Member
 

Re: File Headers for data carving

Post Posted: Aug 27, 10 08:11

Thanks binarybod. Kessler's list exactly what I was looking for.  
 

Page 1 of 1