extcarve - ext2,ext3,ext4 file carving tool

[Jidong Xiao]

On Wed, Jun 15, 2011 at 9:56 AM, Lakshmipathi.G
<lakshmipathi.g at gmail.com> wrote:
>
>
> On Wed, Jun 15, 2011 at 6:49 PM, Jidong Xiao <jidong.xiao at gmail.com> wrote:
>>
>> My file system is ext3.
>>
>> In addition, my partition size is very large, it is 400GB. Is that a
>> problem?
>>
>> I tried extcarve at two machines, both got the same results, i.e.,
>> only generated some 4KB non-sense files there.
>>
>
> ext3 shouldn't be a problem. Give a try with "-i" option,  for the third
> input provide 256 as input. So that , It'll try upto 1MB files.
> ----
> Please enter increased block limit:(default is 12) :256
> ----
> Does that produce files greater than 4KB size ?
>
>
Yes by using -i and 256 as the third input, I can generate a few files
whose size is large than 4KB.

Here are the results: Most of the files are still 4KB and not
meaningful, some files whose size are 8KB, but still not meaningful,
i.e., only some unknown and strange contents in those files, only
those pdf files whose size are larger than 8KB are real files, they
are useful files.

Since my partition size is 400GB, I should have far more files than
here, but at two of my machines, extcarve stalled at some step, it
seems the process is still there but it stops generating more files.

jxiao at th107c-6:~> ls -l /mnt/usbstick/RECARVED_FILES/
total 384
-rwxrwxrwx 1 root root  4096 Jun 15 11:13 extcarve1RITdT.cpp
-rwxrwxrwx 1 root root  4096 Jun 15 11:13 extcarve1s8oaZ.cpp
-rwxrwxrwx 1 root root  4096 Jun 15 11:13 extcarve2lIpqA.cpp
-rwxrwxrwx 1 root root 28672 Jun 15 11:13 extcarve2vm7gW.pdf
-rwxrwxrwx 1 root root  4096 Jun 15 11:13 extcarve3JXkZD.cpp
-rwxrwxrwx 1 root root  4096 Jun 15 11:13 extcarve7FI0YM.cpp
-rwxrwxrwx 1 root root  4096 Jun 15 11:13 extcarve7kADgL.cpp
-rwxrwxrwx 1 root root  8192 Jun 15 11:13 extcarve8wouIy.pdf
-rwxrwxrwx 1 root root  4096 Jun 15 11:13 extcarvebqkCDK.cpp
-rwxrwxrwx 1 root root  8192 Jun 15 11:13 extcarveCbKucU.pdf
-rwxrwxrwx 1 root root  4096 Jun 15 11:07 extcarveCGxSgK.png
-rwxrwxrwx 1 root root  8192 Jun 15 11:13 extcarvecmUimP.pdf
-rwxrwxrwx 1 root root  4096 Jun 15 11:08 extcarved8HC0z.png
-rwxrwxrwx 1 root root  4096 Jun 15 11:13 extcarveD9ZSjI.cpp
-rwxrwxrwx 1 root root  4096 Jun 15 11:13 extcarveDO7CIl.cpp
-rwxrwxrwx 1 root root 36864 Jun 15 11:13 extcarvedqoMd4.pdf
-rwxrwxrwx 1 root root  4096 Jun 15 11:13 extcarvedWuCvQ.cpp
-rwxrwxrwx 1 root root  4096 Jun 15 11:08 extcarveeCrRf1.png
-rwxrwxrwx 1 root root  4096 Jun 15 11:13 extcarveEfGMQZ.cpp
-rwxrwxrwx 1 root root  4096 Jun 15 11:13 extcarveGdJ8hw.cpp
-rwxrwxrwx 1 root root  8192 Jun 15 11:13 extcarvegf35Oa.pdf
-rwxrwxrwx 1 root root 24576 Jun 15 11:13 extcarvegXLHGf.pdf
-rwxrwxrwx 1 root root  4096 Jun 15 11:13 extcarveGZenG1.cpp
-rwxrwxrwx 1 root root  4096 Jun 15 11:13 extcarvehCFJFW.cpp
-rwxrwxrwx 1 root root  4096 Jun 15 11:13 extcarveiYO3Jp.cpp
-rwxrwxrwx 1 root root  4096 Jun 15 11:13 extcarveJkY8r1.cpp
-rwxrwxrwx 1 root root  4096 Jun 15 11:13 extcarveKyRrks.cpp
-rwxrwxrwx 1 root root  4096 Jun 15 11:08 extcarvemPFqvs.png
-rwxrwxrwx 1 root root 32768 Jun 15 11:13 extcarvenAtFWu.pdf
-rwxrwxrwx 1 root root  8192 Jun 15 11:13 extcarveNiJHTt.pdf
-rwxrwxrwx 1 root root  4096 Jun 15 11:13 extcarveoKb9bp.cpp
-rwxrwxrwx 1 root root  4096 Jun 15 11:13 extcarveotikLR.cpp
-rwxrwxrwx 1 root root  4096 Jun 15 11:13 extcarveP194o9.cpp
-rwxrwxrwx 1 root root  4096 Jun 15 11:13 extcarvep9q2Oe.cpp
-rwxrwxrwx 1 root root  4096 Jun 15 11:13 extcarveqiQFRN.cpp
-rwxrwxrwx 1 root root  8192 Jun 15 11:13 extcarveqmfEed.pdf
-rwxrwxrwx 1 root root  4096 Jun 15 11:13 extcarveRF2d55.cpp
-rwxrwxrwx 1 root root 28672 Jun 15 11:13 extcarvesKXZwr.pdf
-rwxrwxrwx 1 root root  4096 Jun 15 11:13 extcarvesuUtai.cpp
-rwxrwxrwx 1 root root  4096 Jun 15 11:13 extcarveTDXWSm.cpp
-rwxrwxrwx 1 root root  4096 Jun 15 11:13 extcarveTQV47h.cpp
-rwxrwxrwx 1 root root  4096 Jun 15 11:13 extcarveuUmoN6.cpp
-rwxrwxrwx 1 root root  4096 Jun 15 11:13 extcarveVLW6aB.cpp
-rwxrwxrwx 1 root root  4096 Jun 15 11:13 extcarvew73gEx.cpp
-rwxrwxrwx 1 root root 12288 Jun 15 11:13 extcarvew9bYbn.jpg
-rwxrwxrwx 1 root root  8192 Jun 15 11:08 extcarvewEpAGI.cpp
-rwxrwxrwx 1 root root  4096 Jun 15 11:13 extcarveweQmFD.cpp
-rwxrwxrwx 1 root root  4096 Jun 15 11:13 extcarvexamR4b.cpp
-rwxrwxrwx 1 root root  4096 Jun 15 11:13 extcarveY4OWK3.cpp
-rwxrwxrwx 1 root root  4096 Jun 15 11:13 extcarvey5zhr8.cpp
-rwxrwxrwx 1 root root  4096 Jun 15 11:08 extcarveYiwhLT.cpp
-rwxrwxrwx 1 root root  8192 Jun 15 11:13 extcarvezC2MHI.jpg
-rwxrwxrwx 1 root root  4096 Jun 15 11:13 extcarvezGrAFk.cpp
-rwxrwxrwx 1 root root  4096 Jun 15 11:13 extcarveZppUaG.cpp

-Jidong