September 27, 2008 · Backup · 19 comments

Foremost and Scalpel are not interested in the underlying filesystem. They simply expect the data blocks of the files to reside sequentially in the image under investigation. The tools will find images in dd dumps, RAM dumps, or swap files.Carving will help to identify and reconstruct files on corrupt filesystems, in
slack space, or even after installation of a new operating system, as long as the required data blocks still exist.

Continue reading →

Incoming search terms: