support for carving files from other files
Forum rules
When asking for technical support:
- Search for posts on the same topic before posting a new question.
- Give clear, specific information in the title of your post.
- Include as many details as you can, MOST POSTS WILL GET ONLY ONE OR TWO ANSWERS.
- Post a follow up with a "Thank you" or "This worked!"
- When you learn something, use that knowledge to HELP ANOTHER USER LATER.
Before posting, please read https://www.cgsecurity.org/testdisk.pdf
When asking for technical support:
- Search for posts on the same topic before posting a new question.
- Give clear, specific information in the title of your post.
- Include as many details as you can, MOST POSTS WILL GET ONLY ONE OR TWO ANSWERS.
- Post a follow up with a "Thank you" or "This worked!"
- When you learn something, use that knowledge to HELP ANOTHER USER LATER.
Before posting, please read https://www.cgsecurity.org/testdisk.pdf
-
cgrenier
- Site Admin
- Posts: 5438
- Joined: 18 Feb 2012, 15:08
- Location: Le Perreux Sur Marne, France
- Contact:
Re: support for carving files from other files
If you mean carving from dd or EWF image, run "photorec file.dd".
If your goal is to carve embedded files, ie jpg from a .doc,officially, you can try but it's not officially supported.
If your goal is to carve embedded files, ie jpg from a .doc,officially, you can try
Code: Select all
photorec /d recup_dir /cmd file.doc blocksize,1,fileopt,txt,disable,searchRe: support for carving files from other files
yes, i want to carve embedded files. i tried with the xm filetype because the file contains xm files in it, and it doesn't recover anything.
the test file https://www.rapidshare.com/files/581506371/testfile.
also, is support for that planned?
the test file https://www.rapidshare.com/files/581506371/testfile.
also, is support for that planned?
-
cgrenier
- Site Admin
- Posts: 5438
- Joined: 18 Feb 2012, 15:08
- Location: Le Perreux Sur Marne, France
- Contact:
Re: support for carving files from other files
Currently xm files are detected only if they begins by the signature "Extended Module: ". It's not the case here.
Re: support for carving files from other files
i uploaded by accident a different file containing mod tracker files (which by the way aren't supported. is support for the mod file type planned?). this is the file containing the xm files. https://www.rapidshare.com/files/3055337305/testfile2.
i checked it with a hex editor and it doesn't contain that string. it has protection.
i checked it with a hex editor and it doesn't contain that string. it has protection.