File Headers for da...
 
Notifications
Clear all

File Headers for data carving

5 Posts
4 Users
0 Reactions
956 Views
(@dadatacop)
Eminent Member
Joined: 16 years ago
Posts: 21
Topic starter  

I was looking for file headers to try and carve out data from unallocated space on a drive where the suspect re-installed the OS (Vista HP 32-bit). I was able to find a lot of images using the JPG header and the keyword search has found web history data, but I'm looking for documents.

*.doc
*.wpd
*.txt
*.pdf
And any known headers for web based e-mail. Most likely AOL, Yahoo, Hotmail or Gmail.

TIA
Aron


   
Quote
jaclaz
(@jaclaz)
Illustrious Member
Joined: 18 years ago
Posts: 5133
 

I was looking …

WHERE? ?

Or, in other words, is your Google broken? 😯

Like
http//msdn.microsoft.com/en-us/library/cc313153(v=office.12).aspx
http//www.adobe.com/devnet/pdf/pdf_reference.html
http//www.corelconnected.com/html/files/WPFF_!DocumentStructure.htm
(first results in a two minutes search)

*.txt

You sure you want a file header for .txt files? roll

jaclaz


   
ReplyQuote
binarybod
(@binarybod)
Reputable Member
Joined: 17 years ago
Posts: 272
 

Have a look at http//www.garykessler.net/library/file_sigs.html
alternatively in a *nix installation have a look at the magic file usually found in /usr/share/misc/magic

Paul


   
ReplyQuote
(@armresl)
Noble Member
Joined: 21 years ago
Posts: 1011
 

Seriously makes you wonder about the rest of the investigation, when something this basic is asked.

I concur with the WHERE statement.
Also agree with Binary Bod FIRST hit,
http//www.garykessler.net/library/file_sigs.html


   
ReplyQuote
(@dadatacop)
Eminent Member
Joined: 16 years ago
Posts: 21
Topic starter  

Thanks binarybod. Kessler's list exactly what I was looking for.


   
ReplyQuote
Share: