| Author | Message | ||
     Pasquale Stirparo Username: paco Registered: N/A |
Hi All, I've tried to look in the previous post but I didn't find the answer I needed. I'll explain the situation: after a keyword search by SimultanousSearch/Indexing, I found some hits inside some file .wav listed as deleted and in the free space. Inside this .wav file, I found out that there were 3 MS Word file (looking to the hex) and to recover them I wrote a small program in C to which I passed the file .wav and the offset of the MS Word header. My questions are now: - Can I do carving only from a file/s? - The normal "Recovery File by Type" does it carve from the whole disk image, only from the free space (so no slack space)? I'm asking this because I haven't seen any option about "specifying which area/partition/whatever" to perform carving. - In case it does carving on the whole disk, how can I recover files only from the free space? This could be useful in terms of time saving when keywords hits are found on a small free space (a couple of giga) of a disk that may be very big (hundreds of giga). Thank you. Pasquale | ||
| Stefan Fleischmann Username: admin Registered: 1-2001 |
The "File Recovery by Type" command, just like basically every command in the main menu, applies to the currently active window, to whatever it represents (e.g. a disk or a file). So you simply open a file in its own separate data window and the use "File Recovery by Type", it will perform file carving within that file. > does it carve from the whole disk image, > only from the free space (so no slack space)? > I haven't seen any option about "specifying which > area/partition/whatever" to perform carving The option to apply "File Recovery by Type" in allocated, free or all space in a volume is right there in the dialog window. A drop-down box. | ||
| Pasquale Stirparo Username: paco Registered: N/A |
Thanks. Another question: I found a kword in the free space of several disks but I wouldn't like to carve the whole free spaces because they are many and big sized, so it will find many files (I'm talking about ms office files) while carving and then I'll have to search again the kword inside hundreds files. Since I already have the kword position/offset in the free space, is there any way to tell xw to carve "around that area" only? I know it may sound as a "too much request", but since I've seen xw performing every kind of task, actually I wouldn't be to much surprised to receive a positive answer :-) Pasquale | ||
| Stefan Fleischmann Username: admin Registered: 1-2001 |
> is there any way to tell xw to carve "around that area" only? Not automatically. (Generally perhaps better would be to carve first and then run the search.) | ||
| John Singh Username: freshcrop Registered: N/A |
thanks for sharing about File carving from a file [URL="http://www.freshcrop.com"]Data Recovery[/URL] !!! [URL="http://www.freshcropc.com"]Image Recovery[/URL] |