What is file carving
File Carving, Data Carving, or just Carving is a general term for
extracting data (files) out of raw data, much like "carving" a sculpture from a
stone.
It is the practice of searching for files based on internal
content, rather than known information such as that supplied by a file system.
File carving is a powerful tool for recovering files and fragments of files when
a file system is not present, damaged, corrupt, or unknown.
File Carving works by looking for file headers and footers, and
then "carving out" the blocks between these two boundaries. Additional accuracy
is achieved by analysis of the contents of identified files to assess if
internal structure conforms with the identified file type.
Phone Image Carver
Is specifically designed for cell phone forensics. It does not
search on sector boundaries, but analyses your phone image file sector by sector
for user select file types.
Does your suspect store .jpeg, .png, .tiff, files on a phone?
Find out in 3 simple steps:
- Select image file;
- Select file types to data carve;
- Scan and preview the search results.
Is there a need for forensic phone hex dumping?
Flashing or dumping a cell phone describes creating either a
hexadecimal or binary image file of cell phone memory. The procedure follows the
established principals of computer forensics where a forensics technician
strives to preserve original evidence in a manner which will demonstrate
integrity and continuity to a court.
The additional benefit of the hex dumping methodology when
compared to real time query based phone analysis is that it allows for the
examination of hidden or deleted data within the image file.
Frequently Asked Qustions (FAQ)
Does Phone Image Carver create hex or binary phone
image files?
- No. Phone Image Carver is concerned
only with analyzing and existing image file to search for specific file
types.
How do I find out how to create phone image files
- Cell phone forensics is an emerging
field. We strongly suggest that if you are starting out you read on-line
articles such as "Hex Dumping Primer" (by Michael Harrington CFCE, EnCE).
Does your tool talk directly to a phone
- No. Phone image carver will run only
on image files.
The file type I am not looking for is not
listed. What can I do?
- It is possible to add
new file types to Phone Image Carver. Please contact us and provide as
much information as possible as to the format and author of the file
type. Please send us sample files, or image files, if possible.
The image file is not supported by Phone Image Carver. What can i do?
- Some phone flashing program uses a
proprietary format to create and store image files. It may be possible
to add image formats, particularly if the author of the file format is
willing to provide assistance. Please provide a sample of the image file
and information about the creating software, including the version
number.
Will Phone Image Carver find fragmented files?
Can I try Phone Image Carver before I purchase a license?
- Yes. Download and try the software in
evaluation mode. It will allow you to search an image file and display
the results in the search results screen. A product activation key is
required to save the search results.
Can I use Phone Image Carver to search EnCase image files of hard
drives?
-
Technically you can do this. However, Phone Image Carver is specifically
designed to search phone
image files because it
searches sector by sector. Phone image files are usually relatively
small.
If you wish to search large EnCase or FTK image files of hard drives,
use Recover My Files from www.recovermyfiles.com. This program is suited
to this task because it uses data carving techniques at sector
boundaries.