Selective file dumper
|This article needs additional citations for verification. (June 2017) (Learn how and when to remove this template message)|
|Original author(s)||Nanni Bassetti and Denis Frati|
1.5 / March 21, 2008
|Written in||Bash (shell script)|
|License||GNU General Public License
GNU Lesser General Public License
It is a Bash script which can retrieve all the files of a chosen type (e.g. .doc or .jpg), regardless if they are active, deleted or unallocated. It automatically runs Foremost for carving, and Sleuthkit for deleted files retrieval. It then eliminates duplicated files by comparing the SHA256 hashes of the carved files and the active and deleted files. Thanks to carving, files simply renamed to a different extension will be identified. Also, it is possible to expand the Foremost configuration file inside the script to add new extensions. Finally, it is possible to do a keyword search on the extracted files. The script can work on an image file or directly from a device.