Forums
Main Category
General (Technical,...
Data Carving- recon...
 
Notifications
Clear all

Data Carving- reconstructing a file from its fragments

 
General (Technical, Procedural, Software, Hardware etc.)
Last Post by mscotgrove 12 years ago
5 Posts
4 Users
0 Reactions
1,029 Views
RSS
 unbreakable
(@unbreakable)
New Member
Joined: 12 years ago
Posts: 2
Topic starter 02/06/2013 8:02 pm  

Hi ,

I need someone to help me out with a task in data carving. I have fragments of a file and I need to put them together to form the single file. I need to know tools and guidelines on how to do this. I checked through google and most of the tools i got were those that would help me carve the fragments of the data out of slack spaces and not to put them together to form the file.

I think the file is a jpeg because encase and FTK showed me that one of the fragment was a jpeg file whose extension was changed. Kindly mail me on adetunji@myriadview,com if you want me to send the files to you. I wished I could attach them here.

I would also like contributions about other file formats other than jpeg


   
Quote
EricZimmerman
 EricZimmerman
(@ericzimmerman)
Estimable Member
Joined: 13 years ago
Posts: 222
02/06/2013 8:58 pm  

if you have all the chunks concatenate them together. i leave it up to you to find a tool that does that for your platform. this of course assumes you know the order with which to put them back together.


   
ReplyQuote
jaclaz
 jaclaz
(@jaclaz)
Illustrious Member
Joined: 18 years ago
Posts: 5133
02/06/2013 9:34 pm  

Generally speaking JPEG files are not the "easiest" to put together from fragments.
But depending on the number and size of the fragments, even if you don't manage to put them together fully, you may be able to recover the EXIF data and/or the thumbnail (if any) of the file.
A tool that is often cited when it comes to corrupted photo or carved fragments is Adroit
http//www.smartcarver.com/

jaclaz


   
ReplyQuote
 unbreakable
(@unbreakable)
New Member
Joined: 12 years ago
Posts: 2
Topic starter 02/06/2013 10:15 pm  

Generally speaking JPEG files are not the "easiest" to put together from fragments.
But depending on the number and size of the fragments, even if you don't manage to put them together fully, you may be able to recover the EXIF data and/or the thumbnail (if any) of the file.
A tool that is often cited when it comes to corrupted photo or carved fragments is Adroit
http//www.smartcarver.com/

jaclaz

Thanks guys. I appreciate your contributions.

cheers


   
ReplyQuote
 mscotgrove
(@mscotgrove)
Prominent Member
Joined: 17 years ago
Posts: 940
03/06/2013 1:29 am  

I am doing work on fragmented video - some notes in the link below

http//www.cnwrecovery.com/html/Defragmenting_Video.pdf

Processing fragmented files works best when there is a good structure to file, often with tags and lengths of tags. It is then possible to search clusters for a cluster with an expected tag at the correct offset within the cluster. The next problem then comes with making sure that sections are joined to the correct file.

ZIP/DOCX can be processed in this way and can work well as long as each section is not much longer than the logical cluster size.

JPEGs are harder


   
ReplyQuote
Forum Jump:
  Previous Topic
Next Topic  
Share: