Page 1 of 1
support for carving files from other files
Posted: 23 Mar 2012, 05:16
by pokemon
.
Re: support for carving files from other files
Posted: 23 Mar 2012, 07:29
by cgrenier
If you mean carving from dd or EWF image, run "photorec file.dd".
If your goal is to carve embedded files, ie jpg from a .doc,officially, you can try
Code: Select all
photorec /d recup_dir /cmd file.doc blocksize,1,fileopt,txt,disable,search
but it's not officially supported.
Re: support for carving files from other files
Posted: 25 Mar 2012, 04:06
by pokemon
yes, i want to carve embedded files. i tried with the xm filetype because the file contains xm files in it, and it doesn't recover anything.
the test file
https://www.rapidshare.com/files/581506371/testfile.
also, is support for that planned?
Re: support for carving files from other files
Posted: 25 Mar 2012, 09:40
by cgrenier
Currently xm files are detected only if they begins by the signature "Extended Module: ". It's not the case here.
Re: support for carving files from other files
Posted: 25 Mar 2012, 10:22
by pokemon
i uploaded by accident a different file containing mod tracker files (which by the way aren't supported. is support for the mod file type planned?). this is the file containing the xm files.
https://www.rapidshare.com/files/3055337305/testfile2.
i checked it with a hex editor and it doesn't contain that string. it has protection.