Are there any tool (free or commercial) that will rename carved zip files with the correct file extension?
For example, in Encase6, in order to recover Office 2007 documents, I need to carve out zip files. However it's quite tedious to examine each zip to determine its original file extension.
Is this a problem with Encase7? Does it carve out zip file and determine its correct file extension automatically?
Thank you.
x-ways renames things properly as far as i know. if you have any sample data i can verify that for you, but based on my experience, if it knows its a doc file it will give it that extension.
You could just take a report from EnCase, FTK or X-Ways, of those files with the proper extensions in separate column, and write a quick batch file around it to do the appropriate renaming.
This will do what you need, point to a folder containing the live or recovered files and it will rename according to file type
http//
This will determine the type of carved file and rename, eg .DOC. DOCX
It will also try and add a valid date, and possible name based on file metadata
It will also try and optionally process fragmented files - though this is still early development. Success rate is varied.
For a straight Zip file it will include the name and date of the first file to be extracted, and will try and make a truncated file readable by adding a central and end directory section.