[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill:01M6AFSGSXVX54D8MC4ETMF2FC":3,"skill-same:01M6AFSGSXVX54D8MC4ETMF2FC":105},{"skillNo":4,"name":5,"nameZh":6,"description":7,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":16,"categories":17,"keywords":23,"publishedAt":40,"linkOnly":41,"markdownContent":42,"markdownBody":43,"frontMatter":44,"refName":58,"commitSha":59,"skillDirectory":60,"forksCount":61,"repositoryHtmlUrl":62,"repositoryHomepageUrl":63,"ownerHtmlUrl":64,"ownerBlogUrl":65,"ownerDescription":66,"updatedAt":67,"install":68,"resources":81},"01M6AFSGSXVX54D8MC4ETMF2FC","performing-file-carving-with-foremost",null,"Recovers files from disk images and unallocated space using Foremost's header-footer signature carving, extracting evidence independent of the file system's state. Use during digital forensics investigations to carve deleted or fragmented files, such as documents, images, and archives, from raw disk images or unallocated space.","mukul975\u002FAnthropic-Cybersecurity-Skills","mukul975","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F42860185?v=4","01M6ADEQR8T5M4EEG6C67BQCWF","Mahipal","01M6ADJPMYWG1E5GM1FWBE3128",35925,"Apache-2.0","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fperforming-file-carving-with-foremost\u002FSKILL.md",[18],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000023","Skill与智能体开发","SCENARIO","使用场景",[24,25,26,27,28,29,30,31,32,33,34,35,36,37,38,39],"file","performing file carving with foremost","cybersecurity","documents","state","forensics","data","digital-forensics","t1059","t1074","recovery","file-carving","foremost","data-recovery","evidence-recovery","unallocated-space","2026-11-10 10:12:30",false,"---\nname: performing-file-carving-with-foremost\ndescription: Recovers files from disk images and unallocated space using Foremost's\n  header-footer signature carving, extracting evidence independent of the file system's\n  state. Use during digital forensics investigations to carve deleted or fragmented\n  files, such as documents, images, and archives, from raw disk images or unallocated\n  space.\ndomain: cybersecurity\nsubdomain: digital-forensics\ntags:\n- forensics\n- file-carving\n- foremost\n- data-recovery\n- evidence-recovery\n- unallocated-space\nversion: '1.0'\nauthor: mahipal\nlicense: Apache-2.0\nnist_csf:\n- RS.AN-03\n- DE.AE-02\n- RS.MA-01\nmitre_attack:\n- T1005\n- T1074\n- T1119\n- T1070\n- T1059\n---\n\n# Performing File Carving with Foremost\n\n## When to Use\n- When recovering files from unallocated disk space or corrupted file systems\n- For extracting evidence from formatted or wiped storage media\n- When file system metadata is unavailable but raw data sectors contain evidence\n- During investigations requiring recovery of specific file types from raw images\n- As a complement to file system-based recovery for maximum evidence extraction\n\n## Prerequisites\n- Foremost installed on forensic workstation\n- Forensic disk image in raw (dd) format\n- Sufficient output storage (potentially larger than source)\n- Custom foremost.conf for specialized file types (optional)\n- Understanding of file signatures (magic bytes) for target file types\n- Scalpel as an alternative for performance-critical carving\n\n## Workflow\n\n### Step 1: Install and Configure Foremost\n\n```bash\n# Install Foremost\nsudo apt-get install foremost\n\n# Verify installation\nforemost -V\n\n# Review default configuration\ncat \u002Fetc\u002Fforemost.conf\n\n# The default foremost.conf supports:\n# jpg, gif, png, bmp - Image formats\n# avi, exe, mpg, wav - Media and executables\n# riff, wmv, mov, pdf - Documents and video\n# ole (doc\u002Fxls\u002Fppt), zip, rar - Office and archives\n# htm, cpp, java - Text\u002Fcode files\n\n# Create custom configuration for additional file types\ncp \u002Fetc\u002Fforemost.conf \u002Fcases\u002Fcase-2024-001\u002Fcustom_foremost.conf\n\n# Add custom file signatures\ncat \u003C\u003C 'EOF' >> \u002Fcases\u002Fcase-2024-001\u002Fcustom_foremost.conf\n# Custom additions for investigation\n# Format: extension  case_sensitive  max_size  header  footer\n    docx    y    10000000    \\x50\\x4b\\x03\\x04    \\x50\\x4b\\x05\\x06\n    xlsx    y    10000000    \\x50\\x4b\\x03\\x04    \\x50\\x4b\\x05\\x06\n    pptx    y    10000000    \\x50\\x4b\\x03\\x04    \\x50\\x4b\\x05\\x06\n    sqlite  y    50000000    \\x53\\x51\\x4c\\x69\\x74\\x65\\x20\\x66\\x6f\\x72\\x6d\\x61\\x74\n    pst     y    500000000   \\x21\\x42\\x44\\x4e\n    eml     y    1000000     \\x46\\x72\\x6f\\x6d\\x3a    \\x0d\\x0a\\x0d\\x0a\n    evtx    y    50000000    \\x45\\x6c\\x66\\x46\\x69\\x6c\\x65\nEOF\n```\n\n### Step 2: Run Foremost Against the Disk Image\n\n```bash\n# Basic carving of all supported file types\nforemost -t all \\\n   -i \u002Fcases\u002Fcase-2024-001\u002Fimages\u002Fevidence.dd \\\n   -o \u002Fcases\u002Fcase-2024-001\u002Fcarved\u002Fforemost_all\u002F\n\n# Carve only specific file types\nforemost -t jpg,png,pdf,doc,xls,zip \\\n   -i \u002Fcases\u002Fcase-2024-001\u002Fimages\u002Fevidence.dd \\\n   -o \u002Fcases\u002Fcase-2024-001\u002Fcarved\u002Fforemost_targeted\u002F\n\n# Use custom configuration\nforemost -c \u002Fcases\u002Fcase-2024-001\u002Fcustom_foremost.conf \\\n   -i \u002Fcases\u002Fcase-2024-001\u002Fimages\u002Fevidence.dd \\\n   -o \u002Fcases\u002Fcase-2024-001\u002Fcarved\u002Fforemost_custom\u002F\n\n# Carve from a specific partition offset\n# First, find partitions\nmmls \u002Fcases\u002Fcase-2024-001\u002Fimages\u002Fevidence.dd\n# Then carve from unallocated space only\n# Extract unallocated space with blkls\nblkls -o 2048 \u002Fcases\u002Fcase-2024-001\u002Fimages\u002Fevidence.dd \\\n   > \u002Fcases\u002Fcase-2024-001\u002Funallocated.dd\n\nforemost -t all \\\n   -i \u002Fcases\u002Fcase-2024-001\u002Funallocated.dd \\\n   -o \u002Fcases\u002Fcase-2024-001\u002Fcarved\u002Fforemost_unalloc\u002F\n\n# Verbose mode for detailed progress\nforemost -v -t all \\\n   -i \u002Fcases\u002Fcase-2024-001\u002Fimages\u002Fevidence.dd \\\n   -o \u002Fcases\u002Fcase-2024-001\u002Fcarved\u002Fforemost_verbose\u002F 2>&1 | \\\n   tee \u002Fcases\u002Fcase-2024-001\u002Fcarved\u002Fforemost_log.txt\n\n# Indirect mode (process standard input)\ndd if=\u002Fcases\u002Fcase-2024-001\u002Fimages\u002Fevidence.dd bs=512 skip=2048 | \\\n   foremost -t jpg,pdf -o \u002Fcases\u002Fcase-2024-001\u002Fcarved\u002Fforemost_pipe\u002F\n```\n\n### Step 3: Use Scalpel for High-Performance Carving\n\n```bash\n# Install Scalpel (faster alternative based on Foremost)\nsudo apt-get install scalpel\n\n# Edit Scalpel configuration (uncomment desired file types)\ncp \u002Fetc\u002Fscalpel\u002Fscalpel.conf \u002Fcases\u002Fcase-2024-001\u002Fscalpel.conf\n# Uncomment lines for target file types in the config\n\n# Run Scalpel\nscalpel -c \u002Fcases\u002Fcase-2024-001\u002Fscalpel.conf \\\n   -o \u002Fcases\u002Fcase-2024-001\u002Fcarved\u002Fscalpel\u002F \\\n   \u002Fcases\u002Fcase-2024-001\u002Fimages\u002Fevidence.dd\n\n# Scalpel with file size limits\n# Edit scalpel.conf to set appropriate max sizes:\n# jpg  y  5000000  \\xff\\xd8\\xff  \\xff\\xd9\n# pdf  y  20000000 %PDF  %%EOF\n```\n\n### Step 4: Process and Validate Carved Files\n\n```bash\n# Review Foremost audit report\ncat \u002Fcases\u002Fcase-2024-001\u002Fcarved\u002Fforemost_all\u002Faudit.txt\n\n# The audit.txt contains:\n# - Number of files found per type\n# - Start and end offsets\n# - File sizes\n\n# Validate carved files\npython3 \u003C\u003C 'PYEOF'\nimport os\nimport subprocess\nfrom collections import defaultdict\n\ncarved_dir = '\u002Fcases\u002Fcase-2024-001\u002Fcarved\u002Fforemost_all\u002F'\nstats = defaultdict(lambda: {'total': 0, 'valid': 0, 'invalid': 0, 'size': 0})\n\nfor subdir in os.listdir(carved_dir):\n    subdir_path = os.path.join(carved_dir, subdir)\n    if not os.path.isdir(subdir_path) or subdir == 'audit.txt':\n        continue\n\n    for filename in os.listdir(subdir_path):\n        filepath = os.path.join(subdir_path, filename)\n        if not os.path.isfile(filepath):\n            continue\n\n        ext = subdir\n        filesize = os.path.getsize(filepath)\n        stats[ext]['total'] += 1\n        stats[ext]['size'] += filesize\n\n        # Validate file using 'file' command\n        result = subprocess.run(['file', '--brief', filepath], capture_output=True, text=True)\n        file_type = result.stdout.strip()\n\n        if 'data' in file_type.lower() or 'empty' in file_type.lower():\n            stats[ext]['invalid'] += 1\n        else:\n            stats[ext]['valid'] += 1\n\nprint(\"=== CARVED FILE VALIDATION ===\\n\")\nprint(f\"{'Type':\u003C10} {'Total':\u003C8} {'Valid':\u003C8} {'Invalid':\u003C10} {'Total Size':\u003C15}\")\nprint(\"-\" * 55)\nfor ext in sorted(stats.keys()):\n    s = stats[ext]\n    size_mb = s['size'] \u002F (1024*1024)\n    print(f\"{ext:\u003C10} {s['total']:\u003C8} {s['valid']:\u003C8} {s['invalid']:\u003C10} {size_mb:>10.1f} MB\")\n\n# Remove zero-byte files\nfor subdir in os.listdir(carved_dir):\n    subdir_path = os.path.join(carved_dir, subdir)\n    if os.path.isdir(subdir_path):\n        for filename in os.listdir(subdir_path):\n            filepath = os.path.join(subdir_path, filename)\n            if os.path.isfile(filepath) and os.path.getsize(filepath) == 0:\n                os.remove(filepath)\nPYEOF\n\n# Hash all valid carved files\nfind \u002Fcases\u002Fcase-2024-001\u002Fcarved\u002Fforemost_all\u002F -type f ! -name \"audit.txt\" \\\n   -exec sha256sum {} \\; > \u002Fcases\u002Fcase-2024-001\u002Fcarved\u002Fcarved_file_hashes.txt\n\n# Check against known-bad hash database\n# Check against NSRL known-good database to filter\n```\n\n### Step 5: Examine and Catalog Evidence Files\n\n```bash\n# Extract metadata from carved images (EXIF data including GPS)\nexiftool -r -csv \u002Fcases\u002Fcase-2024-001\u002Fcarved\u002Fforemost_all\u002Fjpg\u002F \\\n   > \u002Fcases\u002Fcase-2024-001\u002Fanalysis\u002Fcarved_image_metadata.csv\n\n# Search carved documents for keywords\nfind \u002Fcases\u002Fcase-2024-001\u002Fcarved\u002Fforemost_all\u002Fpdf\u002F -name \"*.pdf\" -exec pdftotext {} - \\; 2>\u002Fdev\u002Fnull | \\\n   grep -iE '(confidential|secret|password|account|ssn|credit.card)' \\\n   > \u002Fcases\u002Fcase-2024-001\u002Fanalysis\u002Fkeyword_hits_pdf.txt\n\n# Generate thumbnails for image review\nmkdir -p \u002Fcases\u002Fcase-2024-001\u002Fcarved\u002Fthumbnails\u002F\nfind \u002Fcases\u002Fcase-2024-001\u002Fcarved\u002Fforemost_all\u002Fjpg\u002F -name \"*.jpg\" -exec \\\n   convert {} -thumbnail 200x200 \u002Fcases\u002Fcase-2024-001\u002Fcarved\u002Fthumbnails\u002F{} \\; 2>\u002Fdev\u002Fnull\n\n# Create evidence catalog\npython3 \u003C\u003C 'PYEOF'\nimport os, hashlib, csv, subprocess\n\ncatalog = []\ncarved_dir = '\u002Fcases\u002Fcase-2024-001\u002Fcarved\u002Fforemost_all\u002F'\n\nfor subdir in sorted(os.listdir(carved_dir)):\n    subdir_path = os.path.join(carved_dir, subdir)\n    if not os.path.isdir(subdir_path):\n        continue\n    for filename in sorted(os.listdir(subdir_path)):\n        filepath = os.path.join(subdir_path, filename)\n        if not os.path.isfile(filepath):\n            continue\n        size = os.path.getsize(filepath)\n        sha256 = hashlib.sha256(open(filepath, 'rb').read()).hexdigest()\n        file_type = subprocess.run(['file', '--brief', filepath], capture_output=True, text=True).stdout.strip()\n\n        catalog.append({\n            'filename': filename,\n            'type': subdir,\n            'size': size,\n            'sha256': sha256,\n            'file_description': file_type[:100]\n        })\n\nwith open('\u002Fcases\u002Fcase-2024-001\u002Fanalysis\u002Fcarved_file_catalog.csv', 'w', newline='') as f:\n    writer = csv.DictWriter(f, fieldnames=['filename', 'type', 'size', 'sha256', 'file_description'])\n    writer.writeheader()\n    writer.writerows(catalog)\n\nprint(f\"Catalog created with {len(catalog)} files\")\nPYEOF\n```\n\n## Key Concepts\n\n| Concept | Description |\n|---------|-------------|\n| File carving | Recovering files by searching for known header\u002Ffooter byte sequences in raw data |\n| File signature | Unique byte pattern at the start (header) or end (footer) identifying a file type |\n| Unallocated space | Disk sectors not assigned to any file; primary target for carving |\n| Fragmentation | When file data is stored in non-contiguous sectors, complicating carving |\n| Header-footer carving | Extracting data between known file start and end signatures |\n| False positives | Carved data matching file signatures but containing corrupt or unrelated content |\n| Slack space | Unused bytes at the end of a file's last allocated cluster |\n| Sector alignment | Files typically start at sector boundaries, improving carving accuracy |\n\n## Tools & Systems\n\n| Tool | Purpose |\n|------|---------|\n| Foremost | Original header-footer file carving tool developed for US Air Force OSI |\n| Scalpel | High-performance file carver with configurable signatures |\n| PhotoRec | Signature-based file recovery supporting 300+ formats |\n| bulk_extractor | Extracts features (emails, URLs, credit cards) from raw data |\n| blkls | Sleuth Kit tool extracting unallocated space from disk images |\n| mmls | Partition table display for identifying carving targets |\n| ExifTool | Metadata extraction from carved image and document files |\n| hashdeep | Recursive hash computation for carved file cataloging |\n\n## Common Scenarios\n\n**Scenario 1: Recovering Deleted Evidence Documents**\nRun Foremost targeting doc, pdf, xlsx formats against the unallocated space extracted with blkls, validate carved documents, search content for case-relevant keywords, catalog and hash all recoverable documents, present as evidence.\n\n**Scenario 2: Image Recovery from Formatted Media**\nCarve JPEG, PNG, GIF, BMP from a formatted USB drive image, extract EXIF metadata including GPS coordinates and camera information, generate thumbnails for rapid visual review, identify evidence-relevant images, document recovery chain.\n\n**Scenario 3: Email Recovery from Damaged PST**\nUse custom foremost.conf with PST and EML signatures, carve email artifacts from damaged Outlook data file, attempt to open carved PST fragments in a viewer, extract individual EML messages, search for relevant communications.\n\n**Scenario 4: Database Recovery for Financial Investigation**\nConfigure Foremost to carve SQLite databases from unallocated space, recover application databases that were deleted, query recovered databases for financial records, cross-reference with known transaction data, document findings for prosecution.\n\n## Output Format\n\n```\nFile Carving Summary:\n  Tool: Foremost 1.5.7\n  Source: evidence.dd (500 GB)\n  Target: Unallocated space (234 GB)\n  Duration: 1h 45m\n\n  Files Carved:\n    jpg:    2,345 files (1.8 GB) - Valid: 2,100 \u002F Invalid: 245\n    png:      234 files (456 MB) - Valid: 210 \u002F Invalid: 24\n    pdf:      156 files (890 MB) - Valid: 134 \u002F Invalid: 22\n    doc:       89 files (234 MB) - Valid: 67 \u002F Invalid: 22\n    xls:       45 files (123 MB) - Valid: 38 \u002F Invalid: 7\n    zip:       67 files (567 MB) - Valid: 52 \u002F Invalid: 15\n    exe:       34 files (234 MB) - Valid: 30 \u002F Invalid: 4\n    sqlite:    12 files (89 MB)  - Valid: 10 \u002F Invalid: 2\n\n  Total Files: 2,982 (3.4 GB recovered)\n  Evidence-Relevant: 45 files flagged for review\n  Audit Log: \u002Fcases\u002Fcase-2024-001\u002Fcarved\u002Fforemost_all\u002Faudit.txt\n  File Catalog: \u002Fcases\u002Fcase-2024-001\u002Fanalysis\u002Fcarved_file_catalog.csv\n```\n","# Performing File Carving with Foremost\n\n## When to Use\n- When recovering files from unallocated disk space or corrupted file systems\n- For extracting evidence from formatted or wiped storage media\n- When file system metadata is unavailable but raw data sectors contain evidence\n- During investigations requiring recovery of specific file types from raw images\n- As a complement to file system-based recovery for maximum evidence extraction\n\n## Prerequisites\n- Foremost installed on forensic workstation\n- Forensic disk image in raw (dd) format\n- Sufficient output storage (potentially larger than source)\n- Custom foremost.conf for specialized file types (optional)\n- Understanding of file signatures (magic bytes) for target file types\n- Scalpel as an alternative for performance-critical carving\n\n## Workflow\n\n### Step 1: Install and Configure Foremost\n\n```bash\n# Install Foremost\nsudo apt-get install foremost\n\n# Verify installation\nforemost -V\n\n# Review default configuration\ncat \u002Fetc\u002Fforemost.conf\n\n# The default foremost.conf supports:\n# jpg, gif, png, bmp - Image formats\n# avi, exe, mpg, wav - Media and executables\n# riff, wmv, mov, pdf - Documents and video\n# ole (doc\u002Fxls\u002Fppt), zip, rar - Office and archives\n# htm, cpp, java - Text\u002Fcode files\n\n# Create custom configuration for additional file types\ncp \u002Fetc\u002Fforemost.conf \u002Fcases\u002Fcase-2024-001\u002Fcustom_foremost.conf\n\n# Add custom file signatures\ncat \u003C\u003C 'EOF' >> \u002Fcases\u002Fcase-2024-001\u002Fcustom_foremost.conf\n# Custom additions for investigation\n# Format: extension  case_sensitive  max_size  header  footer\n    docx    y    10000000    \\x50\\x4b\\x03\\x04    \\x50\\x4b\\x05\\x06\n    xlsx    y    10000000    \\x50\\x4b\\x03\\x04    \\x50\\x4b\\x05\\x06\n    pptx    y    10000000    \\x50\\x4b\\x03\\x04    \\x50\\x4b\\x05\\x06\n    sqlite  y    50000000    \\x53\\x51\\x4c\\x69\\x74\\x65\\x20\\x66\\x6f\\x72\\x6d\\x61\\x74\n    pst     y    500000000   \\x21\\x42\\x44\\x4e\n    eml     y    1000000     \\x46\\x72\\x6f\\x6d\\x3a    \\x0d\\x0a\\x0d\\x0a\n    evtx    y    50000000    \\x45\\x6c\\x66\\x46\\x69\\x6c\\x65\nEOF\n```\n\n### Step 2: Run Foremost Against the Disk Image\n\n```bash\n# Basic carving of all supported file types\nforemost -t all \\\n   -i \u002Fcases\u002Fcase-2024-001\u002Fimages\u002Fevidence.dd \\\n   -o \u002Fcases\u002Fcase-2024-001\u002Fcarved\u002Fforemost_all\u002F\n\n# Carve only specific file types\nforemost -t jpg,png,pdf,doc,xls,zip \\\n   -i \u002Fcases\u002Fcase-2024-001\u002Fimages\u002Fevidence.dd \\\n   -o \u002Fcases\u002Fcase-2024-001\u002Fcarved\u002Fforemost_targeted\u002F\n\n# Use custom configuration\nforemost -c \u002Fcases\u002Fcase-2024-001\u002Fcustom_foremost.conf \\\n   -i \u002Fcases\u002Fcase-2024-001\u002Fimages\u002Fevidence.dd \\\n   -o \u002Fcases\u002Fcase-2024-001\u002Fcarved\u002Fforemost_custom\u002F\n\n# Carve from a specific partition offset\n# First, find partitions\nmmls \u002Fcases\u002Fcase-2024-001\u002Fimages\u002Fevidence.dd\n# Then carve from unallocated space only\n# Extract unallocated space with blkls\nblkls -o 2048 \u002Fcases\u002Fcase-2024-001\u002Fimages\u002Fevidence.dd \\\n   > \u002Fcases\u002Fcase-2024-001\u002Funallocated.dd\n\nforemost -t all \\\n   -i \u002Fcases\u002Fcase-2024-001\u002Funallocated.dd \\\n   -o \u002Fcases\u002Fcase-2024-001\u002Fcarved\u002Fforemost_unalloc\u002F\n\n# Verbose mode for detailed progress\nforemost -v -t all \\\n   -i \u002Fcases\u002Fcase-2024-001\u002Fimages\u002Fevidence.dd \\\n   -o \u002Fcases\u002Fcase-2024-001\u002Fcarved\u002Fforemost_verbose\u002F 2>&1 | \\\n   tee \u002Fcases\u002Fcase-2024-001\u002Fcarved\u002Fforemost_log.txt\n\n# Indirect mode (process standard input)\ndd if=\u002Fcases\u002Fcase-2024-001\u002Fimages\u002Fevidence.dd bs=512 skip=2048 | \\\n   foremost -t jpg,pdf -o \u002Fcases\u002Fcase-2024-001\u002Fcarved\u002Fforemost_pipe\u002F\n```\n\n### Step 3: Use Scalpel for High-Performance Carving\n\n```bash\n# Install Scalpel (faster alternative based on Foremost)\nsudo apt-get install scalpel\n\n# Edit Scalpel configuration (uncomment desired file types)\ncp \u002Fetc\u002Fscalpel\u002Fscalpel.conf \u002Fcases\u002Fcase-2024-001\u002Fscalpel.conf\n# Uncomment lines for target file types in the config\n\n# Run Scalpel\nscalpel -c \u002Fcases\u002Fcase-2024-001\u002Fscalpel.conf \\\n   -o \u002Fcases\u002Fcase-2024-001\u002Fcarved\u002Fscalpel\u002F \\\n   \u002Fcases\u002Fcase-2024-001\u002Fimages\u002Fevidence.dd\n\n# Scalpel with file size limits\n# Edit scalpel.conf to set appropriate max sizes:\n# jpg  y  5000000  \\xff\\xd8\\xff  \\xff\\xd9\n# pdf  y  20000000 %PDF  %%EOF\n```\n\n### Step 4: Process and Validate Carved Files\n\n```bash\n# Review Foremost audit report\ncat \u002Fcases\u002Fcase-2024-001\u002Fcarved\u002Fforemost_all\u002Faudit.txt\n\n# The audit.txt contains:\n# - Number of files found per type\n# - Start and end offsets\n# - File sizes\n\n# Validate carved files\npython3 \u003C\u003C 'PYEOF'\nimport os\nimport subprocess\nfrom collections import defaultdict\n\ncarved_dir = '\u002Fcases\u002Fcase-2024-001\u002Fcarved\u002Fforemost_all\u002F'\nstats = defaultdict(lambda: {'total': 0, 'valid': 0, 'invalid': 0, 'size': 0})\n\nfor subdir in os.listdir(carved_dir):\n    subdir_path = os.path.join(carved_dir, subdir)\n    if not os.path.isdir(subdir_path) or subdir == 'audit.txt':\n        continue\n\n    for filename in os.listdir(subdir_path):\n        filepath = os.path.join(subdir_path, filename)\n        if not os.path.isfile(filepath):\n            continue\n\n        ext = subdir\n        filesize = os.path.getsize(filepath)\n        stats[ext]['total'] += 1\n        stats[ext]['size'] += filesize\n\n        # Validate file using 'file' command\n        result = subprocess.run(['file', '--brief', filepath], capture_output=True, text=True)\n        file_type = result.stdout.strip()\n\n        if 'data' in file_type.lower() or 'empty' in file_type.lower():\n            stats[ext]['invalid'] += 1\n        else:\n            stats[ext]['valid'] += 1\n\nprint(\"=== CARVED FILE VALIDATION ===\\n\")\nprint(f\"{'Type':\u003C10} {'Total':\u003C8} {'Valid':\u003C8} {'Invalid':\u003C10} {'Total Size':\u003C15}\")\nprint(\"-\" * 55)\nfor ext in sorted(stats.keys()):\n    s = stats[ext]\n    size_mb = s['size'] \u002F (1024*1024)\n    print(f\"{ext:\u003C10} {s['total']:\u003C8} {s['valid']:\u003C8} {s['invalid']:\u003C10} {size_mb:>10.1f} MB\")\n\n# Remove zero-byte files\nfor subdir in os.listdir(carved_dir):\n    subdir_path = os.path.join(carved_dir, subdir)\n    if os.path.isdir(subdir_path):\n        for filename in os.listdir(subdir_path):\n            filepath = os.path.join(subdir_path, filename)\n            if os.path.isfile(filepath) and os.path.getsize(filepath) == 0:\n                os.remove(filepath)\nPYEOF\n\n# Hash all valid carved files\nfind \u002Fcases\u002Fcase-2024-001\u002Fcarved\u002Fforemost_all\u002F -type f ! -name \"audit.txt\" \\\n   -exec sha256sum {} \\; > \u002Fcases\u002Fcase-2024-001\u002Fcarved\u002Fcarved_file_hashes.txt\n\n# Check against known-bad hash database\n# Check against NSRL known-good database to filter\n```\n\n### Step 5: Examine and Catalog Evidence Files\n\n```bash\n# Extract metadata from carved images (EXIF data including GPS)\nexiftool -r -csv \u002Fcases\u002Fcase-2024-001\u002Fcarved\u002Fforemost_all\u002Fjpg\u002F \\\n   > \u002Fcases\u002Fcase-2024-001\u002Fanalysis\u002Fcarved_image_metadata.csv\n\n# Search carved documents for keywords\nfind \u002Fcases\u002Fcase-2024-001\u002Fcarved\u002Fforemost_all\u002Fpdf\u002F -name \"*.pdf\" -exec pdftotext {} - \\; 2>\u002Fdev\u002Fnull | \\\n   grep -iE '(confidential|secret|password|account|ssn|credit.card)' \\\n   > \u002Fcases\u002Fcase-2024-001\u002Fanalysis\u002Fkeyword_hits_pdf.txt\n\n# Generate thumbnails for image review\nmkdir -p \u002Fcases\u002Fcase-2024-001\u002Fcarved\u002Fthumbnails\u002F\nfind \u002Fcases\u002Fcase-2024-001\u002Fcarved\u002Fforemost_all\u002Fjpg\u002F -name \"*.jpg\" -exec \\\n   convert {} -thumbnail 200x200 \u002Fcases\u002Fcase-2024-001\u002Fcarved\u002Fthumbnails\u002F{} \\; 2>\u002Fdev\u002Fnull\n\n# Create evidence catalog\npython3 \u003C\u003C 'PYEOF'\nimport os, hashlib, csv, subprocess\n\ncatalog = []\ncarved_dir = '\u002Fcases\u002Fcase-2024-001\u002Fcarved\u002Fforemost_all\u002F'\n\nfor subdir in sorted(os.listdir(carved_dir)):\n    subdir_path = os.path.join(carved_dir, subdir)\n    if not os.path.isdir(subdir_path):\n        continue\n    for filename in sorted(os.listdir(subdir_path)):\n        filepath = os.path.join(subdir_path, filename)\n        if not os.path.isfile(filepath):\n            continue\n        size = os.path.getsize(filepath)\n        sha256 = hashlib.sha256(open(filepath, 'rb').read()).hexdigest()\n        file_type = subprocess.run(['file', '--brief', filepath], capture_output=True, text=True).stdout.strip()\n\n        catalog.append({\n            'filename': filename,\n            'type': subdir,\n            'size': size,\n            'sha256': sha256,\n            'file_description': file_type[:100]\n        })\n\nwith open('\u002Fcases\u002Fcase-2024-001\u002Fanalysis\u002Fcarved_file_catalog.csv', 'w', newline='') as f:\n    writer = csv.DictWriter(f, fieldnames=['filename', 'type', 'size', 'sha256', 'file_description'])\n    writer.writeheader()\n    writer.writerows(catalog)\n\nprint(f\"Catalog created with {len(catalog)} files\")\nPYEOF\n```\n\n## Key Concepts\n\n| Concept | Description |\n|---------|-------------|\n| File carving | Recovering files by searching for known header\u002Ffooter byte sequences in raw data |\n| File signature | Unique byte pattern at the start (header) or end (footer) identifying a file type |\n| Unallocated space | Disk sectors not assigned to any file; primary target for carving |\n| Fragmentation | When file data is stored in non-contiguous sectors, complicating carving |\n| Header-footer carving | Extracting data between known file start and end signatures |\n| False positives | Carved data matching file signatures but containing corrupt or unrelated content |\n| Slack space | Unused bytes at the end of a file's last allocated cluster |\n| Sector alignment | Files typically start at sector boundaries, improving carving accuracy |\n\n## Tools & Systems\n\n| Tool | Purpose |\n|------|---------|\n| Foremost | Original header-footer file carving tool developed for US Air Force OSI |\n| Scalpel | High-performance file carver with configurable signatures |\n| PhotoRec | Signature-based file recovery supporting 300+ formats |\n| bulk_extractor | Extracts features (emails, URLs, credit cards) from raw data |\n| blkls | Sleuth Kit tool extracting unallocated space from disk images |\n| mmls | Partition table display for identifying carving targets |\n| ExifTool | Metadata extraction from carved image and document files |\n| hashdeep | Recursive hash computation for carved file cataloging |\n\n## Common Scenarios\n\n**Scenario 1: Recovering Deleted Evidence Documents**\nRun Foremost targeting doc, pdf, xlsx formats against the unallocated space extracted with blkls, validate carved documents, search content for case-relevant keywords, catalog and hash all recoverable documents, present as evidence.\n\n**Scenario 2: Image Recovery from Formatted Media**\nCarve JPEG, PNG, GIF, BMP from a formatted USB drive image, extract EXIF metadata including GPS coordinates and camera information, generate thumbnails for rapid visual review, identify evidence-relevant images, document recovery chain.\n\n**Scenario 3: Email Recovery from Damaged PST**\nUse custom foremost.conf with PST and EML signatures, carve email artifacts from damaged Outlook data file, attempt to open carved PST fragments in a viewer, extract individual EML messages, search for relevant communications.\n\n**Scenario 4: Database Recovery for Financial Investigation**\nConfigure Foremost to carve SQLite databases from unallocated space, recover application databases that were deleted, query recovered databases for financial records, cross-reference with known transaction data, document findings for prosecution.\n\n## Output Format\n\n```\nFile Carving Summary:\n  Tool: Foremost 1.5.7\n  Source: evidence.dd (500 GB)\n  Target: Unallocated space (234 GB)\n  Duration: 1h 45m\n\n  Files Carved:\n    jpg:    2,345 files (1.8 GB) - Valid: 2,100 \u002F Invalid: 245\n    png:      234 files (456 MB) - Valid: 210 \u002F Invalid: 24\n    pdf:      156 files (890 MB) - Valid: 134 \u002F Invalid: 22\n    doc:       89 files (234 MB) - Valid: 67 \u002F Invalid: 22\n    xls:       45 files (123 MB) - Valid: 38 \u002F Invalid: 7\n    zip:       67 files (567 MB) - Valid: 52 \u002F Invalid: 15\n    exe:       34 files (234 MB) - Valid: 30 \u002F Invalid: 4\n    sqlite:    12 files (89 MB)  - Valid: 10 \u002F Invalid: 2\n\n  Total Files: 2,982 (3.4 GB recovered)\n  Evidence-Relevant: 45 files flagged for review\n  Audit Log: \u002Fcases\u002Fcase-2024-001\u002Fcarved\u002Fforemost_all\u002Faudit.txt\n  File Catalog: \u002Fcases\u002Fcase-2024-001\u002Fanalysis\u002Fcarved_file_catalog.csv\n```\n",{"name":5,"tags":45,"author":46,"domain":26,"license":15,"version":47,"nist_csf":48,"subdomain":31,"description":7,"mitre_attack":52},[29,35,36,37,38,39],"mahipal","1.0",[49,50,51],"RS.AN-03","DE.AE-02","RS.MA-01",[53,54,55,56,57],"T1005","T1074","T1119","T1070","T1059","main","54a798831d2266a3ca61ce68a7acb80b81160d57","skills\u002Fperforming-file-carving-with-foremost",4384,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills","https:\u002F\u002Fmahipal.engineer\u002FAnthropic-Cybersecurity-Skills\u002F","https:\u002F\u002Fgithub.com\u002Fmukul975","Mahipal.engineer","🔐 Cybersecurity | 💻 Dev | 📷 Street Photographer\r\n🎓 MSc | 📚 Research & AI Security","2026-08-31 12:32:44",{"source":8,"skillName":5,"commands":69,"prompt":79,"zipAvailable":80},[70,73,76],{"tool":71,"command":72},"npx","npx skills add mukul975\u002FAnthropic-Cybersecurity-Skills --skill performing-file-carving-with-foremost",{"tool":74,"command":75},"bunx","bunx skills add mukul975\u002FAnthropic-Cybersecurity-Skills --skill performing-file-carving-with-foremost",{"tool":77,"command":78},"pnpm","pnpm dlx skills add mukul975\u002FAnthropic-Cybersecurity-Skills --skill performing-file-carving-with-foremost","安装技能，技能地址：https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fperforming-file-carving-with-foremost\u002FSKILL.md",true,[82,87,93,99],{"path":83,"resourceType":83,"resourceTypeDesc":84,"sizeBytes":85,"sourceHtmlUrl":86},"LICENSE","许可证",11255,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fperforming-file-carving-with-foremost\u002FLICENSE",{"path":88,"resourceType":89,"resourceTypeDesc":90,"sizeBytes":91,"sourceHtmlUrl":92},"references\u002Fapi-reference.md","REFERENCE","参考文档",1537,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fperforming-file-carving-with-foremost\u002Freferences\u002Fapi-reference.md",{"path":94,"resourceType":95,"resourceTypeDesc":96,"sizeBytes":97,"sourceHtmlUrl":98},"scripts\u002Fagent.py","SCRIPT","脚本",6954,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fperforming-file-carving-with-foremost\u002Fscripts\u002Fagent.py",{"path":100,"resourceType":101,"resourceTypeDesc":102,"sizeBytes":103,"sourceHtmlUrl":104},"SKILL.md.tmpl","OTHER","其他",16472,"https:\u002F\u002Fgithub.com\u002Fshengdabai\u002FTony-Claude-Code-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fsetup-gbrain\u002FSKILL.md.tmpl",[106,133,157,184,208,235],{"skillNo":107,"name":108,"nameZh":6,"description":109,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":110,"categories":111,"keywords":113,"publishedAt":40},"01M6AGDM3HJXTKXX15ZZ0ZVCJ3","verifying-build-provenance-with-slsa-sigstore","Verifies artifact signatures and SLSA provenance using Sigstore's cosign (verify, verify-attestation, verify-blob-attestation) and slsa-verifier (verify-artifact), enforcing keyless OIDC builder identity and source repo against SLSA Build levels. Use in CI\u002FCD before deploying artifacts, when consuming third-party attestations, establishing a SLSA Build L3 pipeline, or confirming provenance during incident response or admission control.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fverifying-build-provenance-with-slsa-sigstore\u002FSKILL.md",[112],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},[114,115,116,117,118,26,119,120,121,122,123,124,125,126,127,128,129,130,131,132],"sigstore","provenance","slsa","verifying build provenance with slsa sigstore","security","incident response","identity","pr","code","artifacts","ci","supply-chain","pipeline","supply-chain-security","t1195","attestation","code-signing","cosign","keyless",{"skillNo":134,"name":135,"nameZh":6,"description":136,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":137,"categories":138,"keywords":140,"publishedAt":40},"01M6AGDGBPWYVZ2F11GFKJ4HZ9","validating-tpm-measured-boot-attestation","Verifies TPM 2.0 measured-boot integrity and remote attestation with tpm2-tools -- reading PCRs (tpm2_pcrread), replaying the boot event log, generating and checking signed quotes (tpm2_quote\u002Ftpm2_checkquote), and sealing secrets to a PCR policy. Use to confirm a system booted trusted firmware\u002Fkernel for Zero Trust device posture, detect boot-chain tampering via PCR drift, or build a golden-value baseline for fleet attestation.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fvalidating-tpm-measured-boot-attestation\u002FSKILL.md",[139],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},[141,129,142,143,118,144,26,121,145,146,147,148,149,150,151,152,153,154,155,156],"boot","TPM","validating tpm measured boot attestation","policy","verification","ZeRO","firmware","Tools","measured-boot","PCR","integrity","secrets","remote-attestation","tpm2-tools","integrity-verification","trusted-computing",{"skillNo":158,"name":159,"nameZh":6,"description":160,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":161,"categories":162,"keywords":167,"publishedAt":40},"01M6AGDCW0Y4FXZ3362GT1941M","validating-backup-integrity-for-recovery","Validates backup integrity through cryptographic hash verification, automated restore testing, corruption detection, and recoverability checks to confirm backups are reliable for disaster recovery and ransomware response. Use before relying on backups for recovery, when building post-backup validation pipelines, auditing backup infrastructure for compliance, or checking immutable\u002Fair-gapped backups for silent corruption or tampering.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fvalidating-backup-integrity-for-recovery\u002FSKILL.md",[163,166],{"categoryNo":164,"categoryName":165,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000008","测试与质量",{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},[151,168,34,169,170,26,171,172,145,173,174,175,176,177,178,179,180,181,182,183],"backup","validating backup integrity for recovery","testing","infrastructure","validation","compliance","hash-verification","incident-response","ransomware","cryptocurrency","detection","t1078","t1490","immutable","disaster-recovery","restore-testing",{"skillNo":185,"name":186,"nameZh":6,"description":187,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":188,"categories":189,"keywords":191,"publishedAt":40},"01M6AGD9GBG2KZ336AE763J3WH","triaging-windows-with-kape","Runs KAPE (Kroll Artifact Parser and Extractor) to collect targeted forensic artifacts (registry hives, $MFT, event logs, prefetch, browser data) via Targets and parse them with Modules wrapping Eric Zimmerman's EZ Tools (PECmd, MFTECmd, RECmd). Use during early incident containment\u002Ftriage when full disk imaging is impractical but a defensible, parseable Windows artifact set is needed quickly, including at-scale remote collection.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Ftriaging-windows-with-kape\u002FSKILL.md",[190],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},[192,193,194,26,195,196,197,198,199,200,201,30,202,203,31,204,148,205,206,207],"windows","kape","triaging windows with kape","registry","browser","logs","windows-forensics","dfir","mft","mftecmd","prefetch","eric-zimmerman","SET","collection","pecmd","artifact-collection",{"skillNo":209,"name":210,"nameZh":6,"description":211,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":212,"categories":213,"keywords":215,"publishedAt":40},"01M6AGD5PW5J4EVZM958WD74ZQ","triaging-vulnerabilities-with-ssvc-framework","Triages and prioritizes vulnerabilities with CISA's Stakeholder-Specific Vulnerability Categorization (SSVC) decision tree, weighing exploitation status (via the CISA KEV catalog and FIRST EPSS API), technical impact, automatability, and mission prevalence to output Track\u002FTrack*\u002FAttend\u002FAct decisions. Use when prioritizing vulnerability scan results (OpenVAS, Nessus, Qualys) for remediation planning beyond raw CVSS scores.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Ftriaging-vulnerabilities-with-ssvc-framework\u002FSKILL.md",[214],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},[216,217,218,26,219,220,221,222,223,224,225,226,227,228,229,230,231,232,233,234],"vulnerabilities","framework","triaging vulnerabilities with ssvc framework","status","planning","CISA","vulnerability-management","risk-management","nessus","qualys","openvas","cvss","remediation","risk","vulnerability","api","prioritization","ssvc","decision-tree",{"skillNo":236,"name":237,"nameZh":6,"description":238,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":239,"categories":240,"keywords":242,"publishedAt":40},"01M6AGD24TTQQM4CXG69E3B9TJ","triaging-security-incident","Performs initial triage of security incidents using the NIST SP 800-61r3 and SANS PICERL frameworks, classifying incident type, assigning priority by business impact, and routing to the appropriate response team. Use when a SIEM\u002FEDR alert needs human classification, concurrent alerts must be prioritized, or a user report or threat-intel IOC match requires initial incident categorization.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Ftriaging-security-incident\u002FSKILL.md",[241],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},[118,243,26,244,24,245,246,247,248,249,250,179,251,180,252,253,254,255,256,257],"triaging security incident","siem","ioc","soc","NIST-800-61","NIST","severity","edr","execution","analysis","classification","severity-classification","incident-triage","SANS-PICERL","SOC-operations"]