0

http://webupd8.blogspot.com

Foremost and Scalpel are not interested in the underlying filesystem. They simply expect the data blocks of the files to reside sequentially in the image under investigation. The tools will find images in dd dumps, RAM dumps, or swap files. Carving will help to identify and reconstruct files on corrupt filesystems, in slack space, or even after installation of a new operating system, as long as the required data blocks still exist.

Full story »
nilarimogard's picture
Created by nilarimogard 15 years 50 weeks ago
Category: End User   Tags:

Best karma users