https://github.com/nannib/raw2fs

Bash script for computer forensics - It's possible to resolve the file name starting from the carved file name generated by the Foremost tool and save it, it generates an HTML report. It's possible to resolve the file name starting from the offset of a "grep" keywords search. The tool identifies automatically the change of the partition and, if the keyword is contained into the slack space, saves the sector/cluster/block where it is. (remember that for fat -> sector, ntfs -> cluster, ext2/3 -> block) (The SleuthKit based)
https://github.com/nannib/raw2fs

address caine carving digital files filesystem forensics recovery strings

Last synced: about 1 year ago
JSON representation

Bash script for computer forensics - It's possible to resolve the file name starting from the carved file name generated by the Foremost tool and save it, it generates an HTML report. It's possible to resolve the file name starting from the offset of a "grep" keywords search. The tool identifies automatically the change of the partition and, if the keyword is contained into the slack space, saves the sector/cluster/block where it is. (remember that for fat -> sector, ntfs -> cluster, ext2/3 -> block) (The SleuthKit based)

• Host: GitHub
• URL: https://github.com/nannib/raw2fs
• Owner: nannib
• Created: 2015-12-06T08:29:16.000Z (over 10 years ago)
• Default Branch: master
• Last Pushed: 2015-12-06T09:16:14.000Z (over 10 years ago)
• Last Synced: 2025-03-31T03:32:23.739Z (over 1 year ago)
• Topics: address, caine, carving, digital, files, filesystem, forensics, recovery, strings
• Language: Shell
• Homepage:
• Size: 4.88 KB
• Stars: 8
• Watchers: 1
• Forks: 2
• Open Issues: 0
• Metadata Files:
  • Readme: README.md

Awesome Lists containing this project

README

          
# Raw2FS

Bash script for computer forensics - It's possible to resolve the file name starting from the carved file name generated by 

the Foremost tool and save it, it generates an HTML report. It's possible to resolve the 

file name starting from the offset of a "grep" keywords search. The tool identifies automatically 

the change of the partition and, if the keyword is contained into 

the slack space, saves the sector/cluster/block where it is. 

(remember that for fat -> sector, ntfs -> cluster, ext2/3 -> block) (The SleuthKit based)