Follow

What is the significance of the numbers in a carved file's name?

Created by: Brendan Bone
Created date:
Last Updated date:

Question

What is the significance of the numbers in a carved file's name?

 

Answer


FTK assigns names like "Carved[xxxxx].jpg".
The number within the brackets is the byte decimal offset count from the first byte of the parent file from which the file was carved.

 

Examples


File name: Carved[12345].jpg
Path: Mantooth2.E01/Partition 1/MANTOOTH [NTFS]/[unallocated space]/006350>>Carved[12345].jpg
Interpretation: The carved file was found beginning at decimal byte offset 12345 within the unallocated chunk "006350".

File name: Carved[789].bmp
Path: Mantooth2.E01/Partition 1/MANTOOTH [NTFS]/[root]/Documents/MyFile.doc>>Carved[789].bmp
Interpretation: The carved file was found beginning at decimal byte offset 789 within "MyFile.doc".

 

Overview

A carved file, by definition, is a file that is not recorded in the file system records but can found within another data stream.  Carved files do not have names or metadata, so FTK assigns its own names.

Was this article helpful?
0 out of 0 found this helpful
Have more questions? Submit a request

Comments

Powered by Zendesk