Magic Rescue scans a block device for file types it knows how to recover and calls an external program to extract them. It looks at "magic bytes" in file contents, so it can be used both as an undelete utility and for recovering a corrupted drive or partition. As long as the file data is there, it will find it.
It may have problems on very fragmented filesystems.
Tuesday, January 08, 2008
Magic Rescue - File Carving tool
Posted by cmihai at 12:09 AM
Labels: Digital Forensics, Open Source
Subscribe to:
Post Comments (Atom)
3 comments:
Had you tested Magic Rescue? Do you know whether the tool recover files whether the file system had been destroyed in the disc image.
That's pretty much the idea. It works like Foremost, Scalpel or ReviveIT (Revit).
It doesn't bother with the filesystem, it just parses the RAW disk (image) and looks for file magic headers.
If you're lucky enough to find large unfragmented file chucks, you have your file back.
It's great.Thank you very much!
Post a Comment