File/Data Carving & Recovery Tools

Support HackTricks and get benefits!
Carving & Recovery tools
More tools in https://github.com/Claudio-C/awesome-datarecovery​
Autopsy
The most common tool used in forensics to extract files from images is Autopsy. Download it, install it and make it ingest the file to find "hidden" files. Note that Autopsy is built to support disk images and other kind of images, but not simple files.
Binwalk
Binwalk is a tool for searching binary files like images and audio files for embedded files and data.
It can be installed with apt however the source can be found on github.
Useful commands:
1
sudo apt install binwalk #Insllation
2
binwalk file #Displays the embedded data in the given file
3
binwalk -e file #Displays and extracts some files from the given file
4
binwalk --dd ".*" file #Displays and extracts all files from the given file
Copied!
Foremost
Another common tool to find hidden files is foremost. You can find the configuration file of foremost in /etc/foremost.conf. If you just want to search for some specific files uncomment them. If you don't uncomment anything foremost will search for it's default configured file types.
1
sudo apt-get install foremost
2
foremost -v -i file.img -o output
3
#Discovered files will appear inside the folder "output"
Copied!
Scalpel
Scalpel is another tool that can be use to find and extract files embedded in a file. In this case you will need to uncomment from the configuration file (/etc/scalpel/scalpel.conf) the file types you want it to extract.
1
sudo apt-get install scalpel
2
scalpel file.img -o output
Copied!
Bulk Extractor
This tool comes inside kali but you can find it here: https://github.com/simsong/bulk_extractor​
This tool can scan an image and will extract pcaps inside it, network information(URLs, domains, IPs, MACs, mails) and more files. You only have to do:
1
bulk_extractor memory.img -o out_folder
Copied!
Navigate through all the information that the tool has gathered (passwords?), analyse the packets (read Pcaps analysis), search for weird domains (domains related to malware or non-existent).
PhotoRec
You can find it in https://www.cgsecurity.org/wiki/TestDisk_Download​
It comes with GUI and CLI version. You can select the file-types you want PhotoRec to search for.
binvis
Check the code and the web page tool.
Features of BinVis
visual and active structure viewer
multiple plots for different focus points
focusing on portions of a sample
seeing stings and ressources, in PE or ELF executables e. g.
getting patterns for cryptanalysis on files
spotting packer or encoder algorithms
identify Steganography by patterns
visual binary-diffing
BinVis is a great start-point to get familiar with an unknown target in a black-boxing scenario.
Specific Data Carving Tools
FindAES
Searches for AES keys by searching for their key schedules. Able to find 128. 192, and 256 bit keys, such as those used by TrueCrypt and BitLocker.
Download here.
Complementary tools
You can use viu to see images form the terminal.
You can use the linux command line tool pdftotext to transform a pdf into text and read it.
Support HackTricks and get benefits!

EXT

NTFS

Last modified 19d ago

Copy link

Contents

Carving & Recovery tools

Specific Data Carving Tools

FindAES

Complementary tools