Carving software fo...
 
Notifications
Clear all

Carving software for txt files

8 Posts
7 Users
0 Likes
2,296 Views
(@weresmytriple)
Posts: 8
Active Member
Topic starter
 

hi all

can anyone recommend any good tools for carving txt files, i am really struggling with them as they have no predefined file signature? ideally i need a free to use piece of software

thanks

michael

 
Posted : 09/11/2016 10:55 pm
JaredDM
(@jareddm)
Posts: 118
Estimable Member
 

Try Photorec from CGSecurity http//www.cgsecurity.org/wiki/TestDisk_Download

Pretty good at carving out just about any common file type, and totally free.

 
Posted : 09/11/2016 11:33 pm
(@mcman)
Posts: 189
Estimable Member
 

Like you said, txt files have no signature (header/footer/otherwise) that you could carve for so it's not very likely. You could do strings searches looking for ASCII strings across a disk but you'll get a ton of junk that's not txt files and might not be able to identify where one file starts and another one ends.

Jamie

 
Posted : 10/11/2016 12:05 am
EricZimmerman
(@ericzimmerman)
Posts: 222
Estimable Member
 

if the text is all contiguous you can use my tool, bstrings, to extract all strings.

it has options like minimum and maximum lengths, etc, so you can say, minimum 50 and all the small stuff drops off.

you would still only know the offset of the hit and not a filename since it doesnt really have one. in some cases you may be able to tell what file name it used to have, but not always

 
Posted : 24/11/2016 5:55 pm
jaclaz
(@jaclaz)
Posts: 5133
Illustrious Member
 

if the text is all contiguous you can use my tool, bstrings, to extract all strings.

it has options like minimum and maximum lengths, etc, so you can say, minimum 50 and all the small stuff drops off.

you would still only know the offset of the hit and not a filename since it doesnt really have one. in some cases you may be able to tell what file name it used to have, but not always

Is there a compiled version?
https://github.com/EricZimmerman/bstrings

Just in case, this old tool would probably do ?
http//www.mcafee.com/it/downloads/free-tools/bintext.aspx

jaclaz

 
Posted : 24/11/2016 6:24 pm
EricZimmerman
(@ericzimmerman)
Posts: 222
Estimable Member
 

Yes. Under the releases section or here.

http//ericzimmerman.github.io/

I also have chocolatey packages too

 
Posted : 24/11/2016 6:26 pm
PaulSanderson
(@paulsanderson)
Posts: 651
Honorable Member
 

The first data recovery tool I wrote (1993) was for recovering a lot of text files from a floppy.

As others have said txt files have no header and no footer as such, but if you know the file length, as I did - fat was wiped but I had the root and could rebuild the file system manually - the good old days ) then you would normally expect to find an end of file marker at that offset.

 
Posted : 24/11/2016 9:04 pm
passcodeunlock
(@passcodeunlock)
Posts: 792
Prominent Member
 

When you don't know what you are looking for, eliminate all the data you already know it is not needed. I used the scalpel carving tool to detect chunks of know files

https://github.com/sleuthkit/scalpel

You can define many headers and footers at once - for parameters and configurations see the scalpel documentation.

Whatever scalpel found I overwrote with zeroes, this way the amount of non-zero data decreased to less then 5%, which later on was analyzed manually with a simple hex editor and all the needed text files were recovered successfully.

Be warned that all this should be done on a binary copy of the original, otherwise the process can lead to loosing forever your valuable data!

 
Posted : 27/11/2016 5:10 pm
Share: