Difference between revisions of "Carve"
Jump to navigation
Jump to search
| (3 intermediate revisions by the same user not shown) | |||
| Line 11: | Line 11: | ||
|- | |- | ||
| Message Queue | | Message Queue | ||
| − | | <code>carve</code> | + | | style="text-align:center;" | <code>carve</code> |
|} | |} | ||
This is Truxton's file carver. | This is Truxton's file carver. | ||
| − | Any [[File Types Supported|supported file type]] is searched for in either unallocated space from a drive or file types that are unknown. | + | Any [[File Types Supported|supported file type]] is searched for in either unallocated space from a drive or file types that are [[Type_Unknown|unknown]]. |
By default, the carver attempts to identify files on 512 byte sector boundaries but for high value files just as JPGs, it will search every byte in the sector. | By default, the carver attempts to identify files on 512 byte sector boundaries but for high value files just as JPGs, it will search every byte in the sector. | ||
| + | |||
| + | =Description= | ||
| + | Like any other ETL, file carving is a multi-process and multi-machine endeavor. | ||
| + | By default, Truxton will break the space to be carved into 10MB chunks and put these chunks onto Carve's queue. | ||
| + | This allows the space to be carved in parallel by several machines. | ||
| + | You can change the size of the chunk with the <code> [[Default_ETL_Options|cws]]</code> option. | ||
| + | |||
| + | =Algorithm= | ||
| + | Truxton's carving algorithm is this: | ||
| + | # Scan the chunk for every [[File Types Supported|type]] of file Truxton knows about | ||
| + | # Scanning is done on 512-byte boundaries unless otherwise specified | ||
| + | # When a file has been found, the length of the file is calculated based on the file's format | ||
| + | # The file's format is parsed to produce meta-data information (file name, dates, etc) | ||
| + | # The file meta data is added to the database | ||
| + | # File fragments are recorded for use in [[Stitch|fragmented file carving]] | ||
Latest revision as of 10:52, 8 June 2024
| Executable | Carve.exe
|
| Stage | 4 |
| Percent Complete | 48% |
| Message Queue | carve
|
This is Truxton's file carver. Any supported file type is searched for in either unallocated space from a drive or file types that are unknown.
By default, the carver attempts to identify files on 512 byte sector boundaries but for high value files just as JPGs, it will search every byte in the sector.
Description
Like any other ETL, file carving is a multi-process and multi-machine endeavor.
By default, Truxton will break the space to be carved into 10MB chunks and put these chunks onto Carve's queue.
This allows the space to be carved in parallel by several machines.
You can change the size of the chunk with the cws option.
Algorithm
Truxton's carving algorithm is this:
- Scan the chunk for every type of file Truxton knows about
- Scanning is done on 512-byte boundaries unless otherwise specified
- When a file has been found, the length of the file is calculated based on the file's format
- The file's format is parsed to produce meta-data information (file name, dates, etc)
- The file meta data is added to the database
- File fragments are recorded for use in fragmented file carving
