Carving software for txt files

Try Photorec from CGSecurity http//www.cgsecurity.org/wiki/TestDisk_Download

Pretty good at carving out just about any common file type, and totally free.

Like you said, txt files have no signature (header/footer/otherwise) that you could carve for so it's not very likely. You could do strings searches looking for ASCII strings across a disk but you'll get a ton of junk that's not txt files and might not be able to identify where one file starts and another one ends.

Jamie

if the text is all contiguous you can use my tool, bstrings, to extract all strings.

it has options like minimum and maximum lengths, etc, so you can say, minimum 50 and all the small stuff drops off.

you would still only know the offset of the hit and not a filename since it doesnt really have one. in some cases you may be able to tell what file name it used to have, but not always

if the text is all contiguous you can use my tool, bstrings, to extract all strings.

it has options like minimum and maximum lengths, etc, so you can say, minimum 50 and all the small stuff drops off.

you would still only know the offset of the hit and not a filename since it doesnt really have one. in some cases you may be able to tell what file name it used to have, but not always

Is there a compiled version?
https://github.com/EricZimmerman/bstrings

Just in case, this old tool would probably do ?
http//www.mcafee.com/it/downloads/free-tools/bintext.aspx

jaclaz

Yes. Under the releases section or here.

http//ericzimmerman.github.io/

I also have chocolatey packages too

The first data recovery tool I wrote (1993) was for recovering a lot of text files from a floppy.

As others have said txt files have no header and no footer as such, but if you know the file length, as I did - fat was wiped but I had the root and could rebuild the file system manually - the good old days ) then you would normally expect to find an end of file marker at that offset.

When you don't know what you are looking for, eliminate all the data you already know it is not needed. I used the scalpel carving tool to detect chunks of know files

https://github.com/sleuthkit/scalpel

You can define many headers and footers at once - for parameters and configurations see the scalpel documentation.

Whatever scalpel found I overwrote with zeroes, this way the amount of non-zero data decreased to less then 5%, which later on was analyzed manually with a simple hex editor and all the needed text files were recovered successfully.

Be warned that all this should be done on a binary copy of the original, otherwise the process can lead to loosing forever your valuable data!