File/Data Carving & Recovery Tools
Last updated
Was this helpful?
Last updated
Was this helpful?
More tools in
The most common tool used in forensics to extract files from images is . Download it, install it and make it ingest the file to find "hidden" files. Note that Autopsy is built to support disk images and other kind of images, but not simple files.
Binwalk is a tool for searching binary files like images and audio files for embedded files and data.
It can be installed with apt
however the can be found on github.
Useful commands:
Another common tool to find hidden files is foremost. You can find the configuration file of foremost in /etc/foremost.conf
. If you just want to search for some specific files uncomment them. If you don't uncomment anything foremost will search for it's default configured file types.
Scalpel is another tool that can be use to find and extract files embedded in a file. In this case you will need to uncomment from the configuration file (/etc/scalpel/scalpel.conf) the file types you want it to extract.
This tool can scan an image and will extract pcaps inside it, network information(URLs, domains, IPs, MACs, mails) and more files. You only have to do:
It comes with GUI and CLI version. You can select the file-types you want PhotoRec to search for.
Searches for AES keys by searching for their key schedules. Able to find 128. 192, and 256 bit keys, such as those used by TrueCrypt and BitLocker.
This tool comes inside kali but you can find it here:
Navigate through all the information that the tool has gathered (passwords?), analyse the packets (read), search for weird domains (domains related to malware or non-existent).
You can find it in
Download .
You can use to see images form the terminal. You can use the linux command line tool pdftotext to transform a pdf into text and read it.