extcarve - ext2,ext3,ext4 file carving tool

[Jidong Xiao]

On Tue, Jun 14, 2011 at 11:38 AM, Lakshmipathi.G
<lakshmipathi.g at gmail.com> wrote:
> It did generate some output file under the output directory. However,
> none of these files are the original files. About 196M bytes files are
> generated, however, every single file is of the same size, 4KB.
> That's strange,since  while testing it i have seen files upto 274KB.
>
> were four types of files, cpp/png/gif/pdf. I tried to open the pdf
> files, it could be open, but the contents are not what I expected,
> there are just some weird contents in the pdf file. Actually how can a
> normal pdf be only 4KB?
> I find it difficult to understand why all files are 4KB? What  was the
> command that you have used to invoke extcarve?
> What's your file system's default block size? (Use command : tune2fs -l
> /dev/<your_device>  | grep "Block size") I have tested
> with ext3,ext4 with 4KB as block size.
>>

I was using "extcarve -g".

Here are the information you asked:

test # tune2fs -l /dev/sda3
tune2fs 1.41.14 (22-Dec-2010)
Filesystem volume name:   SCRATCH
Last mounted on:          <not available>
Filesystem UUID:          fe1d144c-7dac-47bf-b28d-c16aa591a1b5
Filesystem magic number:  0xEF53
Filesystem revision #:    1 (dynamic)
Filesystem features:      has_journal ext_attr resize_inode dir_index
filetype sparse_super large_file
Filesystem flags:         signed_directory_hash
Default mount options:    (none)
Filesystem state:         clean
Errors behavior:          Continue
Filesystem OS type:       Linux
Inode count:              28229632
Block count:              112916868
Reserved block count:     5645843
Free blocks:              111069127
Free inodes:              28205356
First block:              0
Block size:               4096
Fragment size:            4096
Reserved GDT blocks:      997
Blocks per group:         32768
Fragments per group:      32768
Inodes per group:         8192
Inode blocks per group:   512
Filesystem created:       Thu Sep 24 07:08:16 2009
Last mount time:          Mon Jun 13 14:59:06 2011
Last write time:          Mon Jun 13 18:06:10 2011
Mount count:              4
Maximum mount count:      28
Last checked:             Thu Jun  2 19:32:20 2011
Check interval:           15552000 (6 months)
Next check after:         Tue Nov 29 18:32:20 2011
Reserved blocks uid:      0 (user root)
Reserved blocks gid:      0 (group root)
First inode:              11
Inode size:               256
Required extra isize:     28
Desired extra isize:      28
Journal inode:            8
Default directory hash:   half_md4
Directory Hash Seed:      254f5863-3bf9-4ae9-ab99-9c433bce0aa8
Journal backup:           inode blocks


Jidong