[Date Prev][Date Next]   [Thread Prev][Thread Next]   [Thread Index] [Date Index] [Author Index]

Re: extcarve - ext2,ext3,ext4 file carving tool



On Tue, Jun 14, 2011 at 3:18 AM, Lakshmipathi.G
<lakshmipathi g gmail com> wrote:
>
>> extcarve, fails to recover any of my files, it is keeping print
>> messages like this:
>>
>> no header found.at all
>> Searching Unused block 415494 which contains non-zero data:
>>
>> no header found.at all
>> Searching Unused block 415495 which contains non-zero data:
>>
>> I saw almost a million of such lines.
>
> It will scan for unused/deleted blocks (415494, 415495 etc). While scanning
> It throws out such  output  messages.
> When I finds valid header+footer it saves them on external drive. As of now,
> extcarve can recover  only limited non-fragmented files of type
> png,jpg,gif,html,c/cpp/php,pdf .(recoverd filename will begin with
> extcarve<random-char>.extenstion)
>
> current version of tool ,will not recover a partial files - It needs to be
> find both header and footer.
>
> extcarve it still running or completed ?   If its completed and didn't
> recover any files ,then possible reason would be -
> 1).Deleted files are fragmented,so extcarve can't find footer.
> 2).Deleted files doesn't belong to currently supported file types.
> 3).Or simply extcarve has a bug,that needs to fixed. :P
>
>
>
It looks like extcarve is completed. Following is the last lines of
output I can see on the screen, and the program stalled there and not
generate any more outputs.

no header found.at all
Searching Unused block 20353513 which contains non-zero data:

no header found.at all
Searching Unused block 20353514 which contains non-zero data:

no header found.at all
Searching Unused block 20353515 which contains non-zero data:

no header found.at all
Searching Unused block 20353516 which contains non-zero data:

n

================================================

It did generate some output file under the output directory. However,
none of these files are the original files. About 196M bytes files are
generated, however, every single file is of the same size, 4KB. There
were four types of files, cpp/png/gif/pdf. I tried to open the pdf
files, it could be open, but the contents are not what I expected,
there are just some weird contents in the pdf file. Actually how can a
normal pdf be only 4KB?

Regards
Jidong


[Date Prev][Date Next]   [Thread Prev][Thread Next]   [Thread Index] [Date Index] [Author Index]