[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill:01M71EJSBSWNJTKT29FKKR166S":3,"skill-same:01M71EJSBSWNJTKT29FKKR166S":83},{"skillNo":4,"name":5,"nameZh":6,"description":7,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":16,"categories":17,"keywords":18,"publishedAt":39,"linkOnly":40,"markdownContent":41,"markdownBody":42,"frontMatter":43,"refName":56,"commitSha":57,"skillDirectory":58,"forksCount":14,"repositoryHtmlUrl":59,"repositoryHomepageUrl":6,"ownerHtmlUrl":60,"ownerBlogUrl":6,"ownerDescription":61,"updatedAt":62,"install":63,"resources":76},"01M71EJSBSWNJTKT29FKKR166S","forensics-disk-filecarving-foremost-detect",null,"Recover files from disk images and unallocated space using Foremost's header-footer signature carving to extract evidence regardless of file system state.","DCx7C5\u002Fai-marketplace","DCx7C5","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F42419559?v=4","01M71C01G2AZV3NTNGWAWSHJPP","DC","01M71C01GQW6G50S2BYMS7PP3E",0,"MIT","https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Flinux\u002Fforensics\u002Fdisk\u002Ffilecarving\u002Fforemost\u002Fdetect\u002FSKILL.md",[],[19,20,21,22,23,24,25,26,27,28,29,30,31,32,33,34,35,36,37,38],"forensics disk filecarving foremost detect","foremost","detect","forensics","disk","unallocated-space","system","evidence-recovery","data-recovery","file-carving","evidence","sonnet","digital-forensics","data","read","de","Bash","cybersecurity","files","images","2026-11-10 10:12:30",false,"---\nname: forensics-disk-filecarving-foremost-detect\ndescription: Recover files from disk images and unallocated space using Foremost's header-footer signature carving to extract evidence regardless of file system state.\ndomain: cybersecurity\nsubdomain: digital-forensics\ntags:\n- forensics\n- file-carving\n- foremost\n- data-recovery\n- evidence-recovery\n- unallocated-space\nnist_csf:\n- RS.AN-01\n- RS.AN-03\n- DE.AE-02\n- RS.MA-01\nmodel: sonnet\nmaxTurns: 20\ntools: [Read, Bash, Glob, Grep]\ncapec: []\n---\n\n# Performing File Carving with Foremost\n\n## When to Use\n- When recovering files from unallocated disk space or corrupted file systems\n- For extracting evidence from formatted or wiped storage media\n- When file system metadata is unavailable but raw data sectors contain evidence\n- During investigations requiring recovery of specific file types from raw images\n- As a complement to file system-based recovery for maximum evidence extraction\n\n## Prerequisites\n- Foremost installed on forensic workstation\n- Forensic disk image in raw (dd) format\n- Sufficient output storage (potentially larger than source)\n- Custom foremost.conf for specialized file types (optional)\n- Understanding of file signatures (magic bytes) for target file types\n- Scalpel as an alternative for performance-critical carving\n\n## Workflow\n\n### Step 1: Install and Configure Foremost\n\n```bash\n# Install Foremost\nsudo apt-get install foremost\n\n# Verify installation\nforemost -V\n\n# Review default configuration\ncat \u002Fetc\u002Fforemost.conf\n\n# The default foremost.conf supports:\n# jpg, gif, png, bmp - Image formats\n# avi, exe, mpg, wav - Media and executables\n# riff, wmv, mov, pdf - Documents and video\n# ole (doc\u002Fxls\u002Fppt), zip, rar - Office and archives\n# htm, cpp, java - Text\u002Fcode files\n\n# Create custom configuration for additional file types\ncp \u002Fetc\u002Fforemost.conf \u002Fcases\u002Fcase-2024-001\u002Fcustom_foremost.conf\n\n# Add custom file signatures\ncat \u003C\u003C 'EOF' >> \u002Fcases\u002Fcase-2024-001\u002Fcustom_foremost.conf\n# Custom additions for investigation\n# Format: extension  case_sensitive  max_size  header  footer\n    docx    y    10000000    \\x50\\x4b\\x03\\x04    \\x50\\x4b\\x05\\x06\n    xlsx    y    10000000    \\x50\\x4b\\x03\\x04    \\x50\\x4b\\x05\\x06\n    pptx    y    10000000    \\x50\\x4b\\x03\\x04    \\x50\\x4b\\x05\\x06\n    sqlite  y    50000000    \\x53\\x51\\x4c\\x69\\x74\\x65\\x20\\x66\\x6f\\x72\\x6d\\x61\\x74\n    pst     y    500000000   \\x21\\x42\\x44\\x4e\n    eml     y    1000000     \\x46\\x72\\x6f\\x6d\\x3a    \\x0d\\x0a\\x0d\\x0a\n    evtx    y    50000000    \\x45\\x6c\\x66\\x46\\x69\\x6c\\x65\nEOF\n```\n\n### Step 2: Run Foremost Against the Disk Image\n\n```bash\n# Basic carving of all supported file types\nforemost -t all \\\n   -i \u002Fcases\u002Fcase-2024-001\u002Fimages\u002Fevidence.dd \\\n   -o \u002Fcases\u002Fcase-2024-001\u002Fcarved\u002Fforemost_all\u002F\n\n# Carve only specific file types\nforemost -t jpg,png,pdf,doc,xls,zip \\\n   -i \u002Fcases\u002Fcase-2024-001\u002Fimages\u002Fevidence.dd \\\n   -o \u002Fcases\u002Fcase-2024-001\u002Fcarved\u002Fforemost_targeted\u002F\n\n# Use custom configuration\nforemost -c \u002Fcases\u002Fcase-2024-001\u002Fcustom_foremost.conf \\\n   -i \u002Fcases\u002Fcase-2024-001\u002Fimages\u002Fevidence.dd \\\n   -o \u002Fcases\u002Fcase-2024-001\u002Fcarved\u002Fforemost_custom\u002F\n\n# Carve from a specific partition offset\n# First, find partitions\nmmls \u002Fcases\u002Fcase-2024-001\u002Fimages\u002Fevidence.dd\n# Then carve from unallocated space only\n# Extract unallocated space with blkls\nblkls -o 2048 \u002Fcases\u002Fcase-2024-001\u002Fimages\u002Fevidence.dd \\\n   > \u002Fcases\u002Fcase-2024-001\u002Funallocated.dd\n\nforemost -t all \\\n   -i \u002Fcases\u002Fcase-2024-001\u002Funallocated.dd \\\n   -o \u002Fcases\u002Fcase-2024-001\u002Fcarved\u002Fforemost_unalloc\u002F\n\n# Verbose mode for detailed progress\nforemost -v -t all \\\n   -i \u002Fcases\u002Fcase-2024-001\u002Fimages\u002Fevidence.dd \\\n   -o \u002Fcases\u002Fcase-2024-001\u002Fcarved\u002Fforemost_verbose\u002F 2>&1 | \\\n   tee \u002Fcases\u002Fcase-2024-001\u002Fcarved\u002Fforemost_log.txt\n\n# Indirect mode (process standard input)\ndd if=\u002Fcases\u002Fcase-2024-001\u002Fimages\u002Fevidence.dd bs=512 skip=2048 | \\\n   foremost -t jpg,pdf -o \u002Fcases\u002Fcase-2024-001\u002Fcarved\u002Fforemost_pipe\u002F\n```\n\n### Step 3: Use Scalpel for High-Performance Carving\n\n```bash\n# Install Scalpel (faster alternative based on Foremost)\nsudo apt-get install scalpel\n\n# Edit Scalpel configuration (uncomment desired file types)\ncp \u002Fetc\u002Fscalpel\u002Fscalpel.conf \u002Fcases\u002Fcase-2024-001\u002Fscalpel.conf\n# Uncomment lines for target file types in the config\n\n# Run Scalpel\nscalpel -c \u002Fcases\u002Fcase-2024-001\u002Fscalpel.conf \\\n   -o \u002Fcases\u002Fcase-2024-001\u002Fcarved\u002Fscalpel\u002F \\\n   \u002Fcases\u002Fcase-2024-001\u002Fimages\u002Fevidence.dd\n\n# Scalpel with file size limits\n# Edit scalpel.conf to set appropriate max sizes:\n# jpg  y  5000000  \\xff\\xd8\\xff  \\xff\\xd9\n# pdf  y  20000000 %PDF  %%EOF\n```\n\n### Step 4: Process and Validate Carved Files\n\n```bash\n# Review Foremost audit report\ncat \u002Fcases\u002Fcase-2024-001\u002Fcarved\u002Fforemost_all\u002Faudit.txt\n\n# The audit.txt contains:\n# - Number of files found per type\n# - Start and end offsets\n# - File sizes\n\n# Validate carved files\npython3 \u003C\u003C 'PYEOF'\nimport os\nimport subprocess\nfrom collections import defaultdict\n\ncarved_dir = '\u002Fcases\u002Fcase-2024-001\u002Fcarved\u002Fforemost_all\u002F'\nstats = defaultdict(lambda: {'total': 0, 'valid': 0, 'invalid': 0, 'size': 0})\n\nfor subdir in os.listdir(carved_dir):\n    subdir_path = os.path.join(carved_dir, subdir)\n    if not os.path.isdir(subdir_path) or subdir == 'audit.txt':\n        continue\n\n    for filename in os.listdir(subdir_path):\n        filepath = os.path.join(subdir_path, filename)\n        if not os.path.isfile(filepath):\n            continue\n\n        ext = subdir\n        filesize = os.path.getsize(filepath)\n        stats[ext]['total'] += 1\n        stats[ext]['size'] += filesize\n\n        # Validate file using 'file' command\n        result = subprocess.run(['file', '--brief', filepath], capture_output=True, text=True)\n        file_type = result.stdout.strip()\n\n        if 'data' in file_type.lower() or 'empty' in file_type.lower():\n            stats[ext]['invalid'] += 1\n        else:\n            stats[ext]['valid'] += 1\n\nprint(\"=== CARVED FILE VALIDATION ===\\n\")\nprint(f\"{'Type':\u003C10} {'Total':\u003C8} {'Valid':\u003C8} {'Invalid':\u003C10} {'Total Size':\u003C15}\")\nprint(\"-\" * 55)\nfor ext in sorted(stats.keys()):\n    s = stats[ext]\n    size_mb = s['size'] \u002F (1024*1024)\n    print(f\"{ext:\u003C10} {s['total']:\u003C8} {s['valid']:\u003C8} {s['invalid']:\u003C10} {size_mb:>10.1f} MB\")\n\n# Remove zero-byte files\nfor subdir in os.listdir(carved_dir):\n    subdir_path = os.path.join(carved_dir, subdir)\n    if os.path.isdir(subdir_path):\n        for filename in os.listdir(subdir_path):\n            filepath = os.path.join(subdir_path, filename)\n            if os.path.isfile(filepath) and os.path.getsize(filepath) == 0:\n                os.remove(filepath)\nPYEOF\n\n# Hash all valid carved files\nfind \u002Fcases\u002Fcase-2024-001\u002Fcarved\u002Fforemost_all\u002F -type f ! -name \"audit.txt\" \\\n   -exec sha256sum {} \\; > \u002Fcases\u002Fcase-2024-001\u002Fcarved\u002Fcarved_file_hashes.txt\n\n# Check against known-bad hash database\n# Check against NSRL known-good database to filter\n```\n\n### Step 5: Examine and Catalog Evidence Files\n\n```bash\n# Extract metadata from carved images (EXIF data including GPS)\nexiftool -r -csv \u002Fcases\u002Fcase-2024-001\u002Fcarved\u002Fforemost_all\u002Fjpg\u002F \\\n   > \u002Fcases\u002Fcase-2024-001\u002Fanalysis\u002Fcarved_image_metadata.csv\n\n# Search carved documents for keywords\nfind \u002Fcases\u002Fcase-2024-001\u002Fcarved\u002Fforemost_all\u002Fpdf\u002F -name \"*.pdf\" -exec pdftotext {} - \\; 2>\u002Fdev\u002Fnull | \\\n   grep -iE '(confidential|secret|password|account|ssn|credit.card)' \\\n   > \u002Fcases\u002Fcase-2024-001\u002Fanalysis\u002Fkeyword_hits_pdf.txt\n\n# Generate thumbnails for image review\nmkdir -p \u002Fcases\u002Fcase-2024-001\u002Fcarved\u002Fthumbnails\u002F\nfind \u002Fcases\u002Fcase-2024-001\u002Fcarved\u002Fforemost_all\u002Fjpg\u002F -name \"*.jpg\" -exec \\\n   convert {} -thumbnail 200x200 \u002Fcases\u002Fcase-2024-001\u002Fcarved\u002Fthumbnails\u002F{} \\; 2>\u002Fdev\u002Fnull\n\n# Create evidence catalog\npython3 \u003C\u003C 'PYEOF'\nimport os, hashlib, csv, subprocess\n\ncatalog = []\ncarved_dir = '\u002Fcases\u002Fcase-2024-001\u002Fcarved\u002Fforemost_all\u002F'\n\nfor subdir in sorted(os.listdir(carved_dir)):\n    subdir_path = os.path.join(carved_dir, subdir)\n    if not os.path.isdir(subdir_path):\n        continue\n    for filename in sorted(os.listdir(subdir_path)):\n        filepath = os.path.join(subdir_path, filename)\n        if not os.path.isfile(filepath):\n            continue\n        size = os.path.getsize(filepath)\n        sha256 = hashlib.sha256(open(filepath, 'rb').read()).hexdigest()\n        file_type = subprocess.run(['file', '--brief', filepath], capture_output=True, text=True).stdout.strip()\n\n        catalog.append({\n            'filename': filename,\n            'type': subdir,\n            'size': size,\n            'sha256': sha256,\n            'file_description': file_type[:100]\n        })\n\nwith open('\u002Fcases\u002Fcase-2024-001\u002Fanalysis\u002Fcarved_file_catalog.csv', 'w', newline='') as f:\n    writer = csv.DictWriter(f, fieldnames=['filename', 'type', 'size', 'sha256', 'file_description'])\n    writer.writeheader()\n    writer.writerows(catalog)\n\nprint(f\"Catalog created with {len(catalog)} files\")\nPYEOF\n```\n\n## Key Concepts\n\n| Concept | Description |\n|---------|-------------|\n| File carving | Recovering files by searching for known header\u002Ffooter byte sequences in raw data |\n| File signature | Unique byte pattern at the start (header) or end (footer) identifying a file type |\n| Unallocated space | Disk sectors not assigned to any file; primary target for carving |\n| Fragmentation | When file data is stored in non-contiguous sectors, complicating carving |\n| Header-footer carving | Extracting data between known file start and end signatures |\n| False positives | Carved data matching file signatures but containing corrupt or unrelated content |\n| Slack space | Unused bytes at the end of a file's last allocated cluster |\n| Sector alignment | Files typically start at sector boundaries, improving carving accuracy |\n\n## Tools & Systems\n\n| Tool | Purpose |\n|------|---------|\n| Foremost | Original header-footer file carving tool developed for US Air Force OSI |\n| Scalpel | High-performance file carver with configurable signatures |\n| PhotoRec | Signature-based file recovery supporting 300+ formats |\n| bulk_extractor | Extracts features (emails, URLs, credit cards) from raw data |\n| blkls | Sleuth Kit tool extracting unallocated space from disk images |\n| mmls | Partition table display for identifying carving targets |\n| ExifTool | Metadata extraction from carved image and document files |\n| hashdeep | Recursive hash computation for carved file cataloging |\n\n## Common Scenarios\n\n**Scenario 1: Recovering Deleted Evidence Documents**\nRun Foremost targeting doc, pdf, xlsx formats against the unallocated space extracted with blkls, validate carved documents, search content for case-relevant keywords, catalog and hash all recoverable documents, present as evidence.\n\n**Scenario 2: Image Recovery from Formatted Media**\nCarve JPEG, PNG, GIF, BMP from a formatted USB drive image, extract EXIF metadata including GPS coordinates and camera information, generate thumbnails for rapid visual review, identify evidence-relevant images, document recovery chain.\n\n**Scenario 3: Email Recovery from Damaged PST**\nUse custom foremost.conf with PST and EML signatures, carve email artifacts from damaged Outlook data file, attempt to open carved PST fragments in a viewer, extract individual EML messages, search for relevant communications.\n\n**Scenario 4: Database Recovery for Financial Investigation**\nConfigure Foremost to carve SQLite databases from unallocated space, recover application databases that were deleted, query recovered databases for financial records, cross-reference with known transaction data, document findings for prosecution.\n\n## Output Format\n\n```\nFile Carving Summary:\n  Tool: Foremost 1.5.7\n  Source: evidence.dd (500 GB)\n  Target: Unallocated space (234 GB)\n  Duration: 1h 45m\n\n  Files Carved:\n    jpg:    2,345 files (1.8 GB) - Valid: 2,100 \u002F Invalid: 245\n    png:      234 files (456 MB) - Valid: 210 \u002F Invalid: 24\n    pdf:      156 files (890 MB) - Valid: 134 \u002F Invalid: 22\n    doc:       89 files (234 MB) - Valid: 67 \u002F Invalid: 22\n    xls:       45 files (123 MB) - Valid: 38 \u002F Invalid: 7\n    zip:       67 files (567 MB) - Valid: 52 \u002F Invalid: 15\n    exe:       34 files (234 MB) - Valid: 30 \u002F Invalid: 4\n    sqlite:    12 files (89 MB)  - Valid: 10 \u002F Invalid: 2\n\n  Total Files: 2,982 (3.4 GB recovered)\n  Evidence-Relevant: 45 files flagged for review\n  Audit Log: \u002Fcases\u002Fcase-2024-001\u002Fcarved\u002Fforemost_all\u002Faudit.txt\n  File Catalog: \u002Fcases\u002Fcase-2024-001\u002Fanalysis\u002Fcarved_file_catalog.csv\n```\n","# Performing File Carving with Foremost\n\n## When to Use\n- When recovering files from unallocated disk space or corrupted file systems\n- For extracting evidence from formatted or wiped storage media\n- When file system metadata is unavailable but raw data sectors contain evidence\n- During investigations requiring recovery of specific file types from raw images\n- As a complement to file system-based recovery for maximum evidence extraction\n\n## Prerequisites\n- Foremost installed on forensic workstation\n- Forensic disk image in raw (dd) format\n- Sufficient output storage (potentially larger than source)\n- Custom foremost.conf for specialized file types (optional)\n- Understanding of file signatures (magic bytes) for target file types\n- Scalpel as an alternative for performance-critical carving\n\n## Workflow\n\n### Step 1: Install and Configure Foremost\n\n```bash\n# Install Foremost\nsudo apt-get install foremost\n\n# Verify installation\nforemost -V\n\n# Review default configuration\ncat \u002Fetc\u002Fforemost.conf\n\n# The default foremost.conf supports:\n# jpg, gif, png, bmp - Image formats\n# avi, exe, mpg, wav - Media and executables\n# riff, wmv, mov, pdf - Documents and video\n# ole (doc\u002Fxls\u002Fppt), zip, rar - Office and archives\n# htm, cpp, java - Text\u002Fcode files\n\n# Create custom configuration for additional file types\ncp \u002Fetc\u002Fforemost.conf \u002Fcases\u002Fcase-2024-001\u002Fcustom_foremost.conf\n\n# Add custom file signatures\ncat \u003C\u003C 'EOF' >> \u002Fcases\u002Fcase-2024-001\u002Fcustom_foremost.conf\n# Custom additions for investigation\n# Format: extension  case_sensitive  max_size  header  footer\n    docx    y    10000000    \\x50\\x4b\\x03\\x04    \\x50\\x4b\\x05\\x06\n    xlsx    y    10000000    \\x50\\x4b\\x03\\x04    \\x50\\x4b\\x05\\x06\n    pptx    y    10000000    \\x50\\x4b\\x03\\x04    \\x50\\x4b\\x05\\x06\n    sqlite  y    50000000    \\x53\\x51\\x4c\\x69\\x74\\x65\\x20\\x66\\x6f\\x72\\x6d\\x61\\x74\n    pst     y    500000000   \\x21\\x42\\x44\\x4e\n    eml     y    1000000     \\x46\\x72\\x6f\\x6d\\x3a    \\x0d\\x0a\\x0d\\x0a\n    evtx    y    50000000    \\x45\\x6c\\x66\\x46\\x69\\x6c\\x65\nEOF\n```\n\n### Step 2: Run Foremost Against the Disk Image\n\n```bash\n# Basic carving of all supported file types\nforemost -t all \\\n   -i \u002Fcases\u002Fcase-2024-001\u002Fimages\u002Fevidence.dd \\\n   -o \u002Fcases\u002Fcase-2024-001\u002Fcarved\u002Fforemost_all\u002F\n\n# Carve only specific file types\nforemost -t jpg,png,pdf,doc,xls,zip \\\n   -i \u002Fcases\u002Fcase-2024-001\u002Fimages\u002Fevidence.dd \\\n   -o \u002Fcases\u002Fcase-2024-001\u002Fcarved\u002Fforemost_targeted\u002F\n\n# Use custom configuration\nforemost -c \u002Fcases\u002Fcase-2024-001\u002Fcustom_foremost.conf \\\n   -i \u002Fcases\u002Fcase-2024-001\u002Fimages\u002Fevidence.dd \\\n   -o \u002Fcases\u002Fcase-2024-001\u002Fcarved\u002Fforemost_custom\u002F\n\n# Carve from a specific partition offset\n# First, find partitions\nmmls \u002Fcases\u002Fcase-2024-001\u002Fimages\u002Fevidence.dd\n# Then carve from unallocated space only\n# Extract unallocated space with blkls\nblkls -o 2048 \u002Fcases\u002Fcase-2024-001\u002Fimages\u002Fevidence.dd \\\n   > \u002Fcases\u002Fcase-2024-001\u002Funallocated.dd\n\nforemost -t all \\\n   -i \u002Fcases\u002Fcase-2024-001\u002Funallocated.dd \\\n   -o \u002Fcases\u002Fcase-2024-001\u002Fcarved\u002Fforemost_unalloc\u002F\n\n# Verbose mode for detailed progress\nforemost -v -t all \\\n   -i \u002Fcases\u002Fcase-2024-001\u002Fimages\u002Fevidence.dd \\\n   -o \u002Fcases\u002Fcase-2024-001\u002Fcarved\u002Fforemost_verbose\u002F 2>&1 | \\\n   tee \u002Fcases\u002Fcase-2024-001\u002Fcarved\u002Fforemost_log.txt\n\n# Indirect mode (process standard input)\ndd if=\u002Fcases\u002Fcase-2024-001\u002Fimages\u002Fevidence.dd bs=512 skip=2048 | \\\n   foremost -t jpg,pdf -o \u002Fcases\u002Fcase-2024-001\u002Fcarved\u002Fforemost_pipe\u002F\n```\n\n### Step 3: Use Scalpel for High-Performance Carving\n\n```bash\n# Install Scalpel (faster alternative based on Foremost)\nsudo apt-get install scalpel\n\n# Edit Scalpel configuration (uncomment desired file types)\ncp \u002Fetc\u002Fscalpel\u002Fscalpel.conf \u002Fcases\u002Fcase-2024-001\u002Fscalpel.conf\n# Uncomment lines for target file types in the config\n\n# Run Scalpel\nscalpel -c \u002Fcases\u002Fcase-2024-001\u002Fscalpel.conf \\\n   -o \u002Fcases\u002Fcase-2024-001\u002Fcarved\u002Fscalpel\u002F \\\n   \u002Fcases\u002Fcase-2024-001\u002Fimages\u002Fevidence.dd\n\n# Scalpel with file size limits\n# Edit scalpel.conf to set appropriate max sizes:\n# jpg  y  5000000  \\xff\\xd8\\xff  \\xff\\xd9\n# pdf  y  20000000 %PDF  %%EOF\n```\n\n### Step 4: Process and Validate Carved Files\n\n```bash\n# Review Foremost audit report\ncat \u002Fcases\u002Fcase-2024-001\u002Fcarved\u002Fforemost_all\u002Faudit.txt\n\n# The audit.txt contains:\n# - Number of files found per type\n# - Start and end offsets\n# - File sizes\n\n# Validate carved files\npython3 \u003C\u003C 'PYEOF'\nimport os\nimport subprocess\nfrom collections import defaultdict\n\ncarved_dir = '\u002Fcases\u002Fcase-2024-001\u002Fcarved\u002Fforemost_all\u002F'\nstats = defaultdict(lambda: {'total': 0, 'valid': 0, 'invalid': 0, 'size': 0})\n\nfor subdir in os.listdir(carved_dir):\n    subdir_path = os.path.join(carved_dir, subdir)\n    if not os.path.isdir(subdir_path) or subdir == 'audit.txt':\n        continue\n\n    for filename in os.listdir(subdir_path):\n        filepath = os.path.join(subdir_path, filename)\n        if not os.path.isfile(filepath):\n            continue\n\n        ext = subdir\n        filesize = os.path.getsize(filepath)\n        stats[ext]['total'] += 1\n        stats[ext]['size'] += filesize\n\n        # Validate file using 'file' command\n        result = subprocess.run(['file', '--brief', filepath], capture_output=True, text=True)\n        file_type = result.stdout.strip()\n\n        if 'data' in file_type.lower() or 'empty' in file_type.lower():\n            stats[ext]['invalid'] += 1\n        else:\n            stats[ext]['valid'] += 1\n\nprint(\"=== CARVED FILE VALIDATION ===\\n\")\nprint(f\"{'Type':\u003C10} {'Total':\u003C8} {'Valid':\u003C8} {'Invalid':\u003C10} {'Total Size':\u003C15}\")\nprint(\"-\" * 55)\nfor ext in sorted(stats.keys()):\n    s = stats[ext]\n    size_mb = s['size'] \u002F (1024*1024)\n    print(f\"{ext:\u003C10} {s['total']:\u003C8} {s['valid']:\u003C8} {s['invalid']:\u003C10} {size_mb:>10.1f} MB\")\n\n# Remove zero-byte files\nfor subdir in os.listdir(carved_dir):\n    subdir_path = os.path.join(carved_dir, subdir)\n    if os.path.isdir(subdir_path):\n        for filename in os.listdir(subdir_path):\n            filepath = os.path.join(subdir_path, filename)\n            if os.path.isfile(filepath) and os.path.getsize(filepath) == 0:\n                os.remove(filepath)\nPYEOF\n\n# Hash all valid carved files\nfind \u002Fcases\u002Fcase-2024-001\u002Fcarved\u002Fforemost_all\u002F -type f ! -name \"audit.txt\" \\\n   -exec sha256sum {} \\; > \u002Fcases\u002Fcase-2024-001\u002Fcarved\u002Fcarved_file_hashes.txt\n\n# Check against known-bad hash database\n# Check against NSRL known-good database to filter\n```\n\n### Step 5: Examine and Catalog Evidence Files\n\n```bash\n# Extract metadata from carved images (EXIF data including GPS)\nexiftool -r -csv \u002Fcases\u002Fcase-2024-001\u002Fcarved\u002Fforemost_all\u002Fjpg\u002F \\\n   > \u002Fcases\u002Fcase-2024-001\u002Fanalysis\u002Fcarved_image_metadata.csv\n\n# Search carved documents for keywords\nfind \u002Fcases\u002Fcase-2024-001\u002Fcarved\u002Fforemost_all\u002Fpdf\u002F -name \"*.pdf\" -exec pdftotext {} - \\; 2>\u002Fdev\u002Fnull | \\\n   grep -iE '(confidential|secret|password|account|ssn|credit.card)' \\\n   > \u002Fcases\u002Fcase-2024-001\u002Fanalysis\u002Fkeyword_hits_pdf.txt\n\n# Generate thumbnails for image review\nmkdir -p \u002Fcases\u002Fcase-2024-001\u002Fcarved\u002Fthumbnails\u002F\nfind \u002Fcases\u002Fcase-2024-001\u002Fcarved\u002Fforemost_all\u002Fjpg\u002F -name \"*.jpg\" -exec \\\n   convert {} -thumbnail 200x200 \u002Fcases\u002Fcase-2024-001\u002Fcarved\u002Fthumbnails\u002F{} \\; 2>\u002Fdev\u002Fnull\n\n# Create evidence catalog\npython3 \u003C\u003C 'PYEOF'\nimport os, hashlib, csv, subprocess\n\ncatalog = []\ncarved_dir = '\u002Fcases\u002Fcase-2024-001\u002Fcarved\u002Fforemost_all\u002F'\n\nfor subdir in sorted(os.listdir(carved_dir)):\n    subdir_path = os.path.join(carved_dir, subdir)\n    if not os.path.isdir(subdir_path):\n        continue\n    for filename in sorted(os.listdir(subdir_path)):\n        filepath = os.path.join(subdir_path, filename)\n        if not os.path.isfile(filepath):\n            continue\n        size = os.path.getsize(filepath)\n        sha256 = hashlib.sha256(open(filepath, 'rb').read()).hexdigest()\n        file_type = subprocess.run(['file', '--brief', filepath], capture_output=True, text=True).stdout.strip()\n\n        catalog.append({\n            'filename': filename,\n            'type': subdir,\n            'size': size,\n            'sha256': sha256,\n            'file_description': file_type[:100]\n        })\n\nwith open('\u002Fcases\u002Fcase-2024-001\u002Fanalysis\u002Fcarved_file_catalog.csv', 'w', newline='') as f:\n    writer = csv.DictWriter(f, fieldnames=['filename', 'type', 'size', 'sha256', 'file_description'])\n    writer.writeheader()\n    writer.writerows(catalog)\n\nprint(f\"Catalog created with {len(catalog)} files\")\nPYEOF\n```\n\n## Key Concepts\n\n| Concept | Description |\n|---------|-------------|\n| File carving | Recovering files by searching for known header\u002Ffooter byte sequences in raw data |\n| File signature | Unique byte pattern at the start (header) or end (footer) identifying a file type |\n| Unallocated space | Disk sectors not assigned to any file; primary target for carving |\n| Fragmentation | When file data is stored in non-contiguous sectors, complicating carving |\n| Header-footer carving | Extracting data between known file start and end signatures |\n| False positives | Carved data matching file signatures but containing corrupt or unrelated content |\n| Slack space | Unused bytes at the end of a file's last allocated cluster |\n| Sector alignment | Files typically start at sector boundaries, improving carving accuracy |\n\n## Tools & Systems\n\n| Tool | Purpose |\n|------|---------|\n| Foremost | Original header-footer file carving tool developed for US Air Force OSI |\n| Scalpel | High-performance file carver with configurable signatures |\n| PhotoRec | Signature-based file recovery supporting 300+ formats |\n| bulk_extractor | Extracts features (emails, URLs, credit cards) from raw data |\n| blkls | Sleuth Kit tool extracting unallocated space from disk images |\n| mmls | Partition table display for identifying carving targets |\n| ExifTool | Metadata extraction from carved image and document files |\n| hashdeep | Recursive hash computation for carved file cataloging |\n\n## Common Scenarios\n\n**Scenario 1: Recovering Deleted Evidence Documents**\nRun Foremost targeting doc, pdf, xlsx formats against the unallocated space extracted with blkls, validate carved documents, search content for case-relevant keywords, catalog and hash all recoverable documents, present as evidence.\n\n**Scenario 2: Image Recovery from Formatted Media**\nCarve JPEG, PNG, GIF, BMP from a formatted USB drive image, extract EXIF metadata including GPS coordinates and camera information, generate thumbnails for rapid visual review, identify evidence-relevant images, document recovery chain.\n\n**Scenario 3: Email Recovery from Damaged PST**\nUse custom foremost.conf with PST and EML signatures, carve email artifacts from damaged Outlook data file, attempt to open carved PST fragments in a viewer, extract individual EML messages, search for relevant communications.\n\n**Scenario 4: Database Recovery for Financial Investigation**\nConfigure Foremost to carve SQLite databases from unallocated space, recover application databases that were deleted, query recovered databases for financial records, cross-reference with known transaction data, document findings for prosecution.\n\n## Output Format\n\n```\nFile Carving Summary:\n  Tool: Foremost 1.5.7\n  Source: evidence.dd (500 GB)\n  Target: Unallocated space (234 GB)\n  Duration: 1h 45m\n\n  Files Carved:\n    jpg:    2,345 files (1.8 GB) - Valid: 2,100 \u002F Invalid: 245\n    png:      234 files (456 MB) - Valid: 210 \u002F Invalid: 24\n    pdf:      156 files (890 MB) - Valid: 134 \u002F Invalid: 22\n    doc:       89 files (234 MB) - Valid: 67 \u002F Invalid: 22\n    xls:       45 files (123 MB) - Valid: 38 \u002F Invalid: 7\n    zip:       67 files (567 MB) - Valid: 52 \u002F Invalid: 15\n    exe:       34 files (234 MB) - Valid: 30 \u002F Invalid: 4\n    sqlite:    12 files (89 MB)  - Valid: 10 \u002F Invalid: 2\n\n  Total Files: 2,982 (3.4 GB recovered)\n  Evidence-Relevant: 45 files flagged for review\n  Audit Log: \u002Fcases\u002Fcase-2024-001\u002Fcarved\u002Fforemost_all\u002Faudit.txt\n  File Catalog: \u002Fcases\u002Fcase-2024-001\u002Fanalysis\u002Fcarved_file_catalog.csv\n```\n",{"name":5,"tags":44,"capec":45,"model":30,"tools":46,"domain":36,"maxTurns":50,"nist_csf":51,"subdomain":31,"description":7},[22,28,20,27,26,24],[],[47,35,48,49],"Read","Glob","Grep",20,[52,53,54,55],"RS.AN-01","RS.AN-03","DE.AE-02","RS.MA-01","main","a91f1293287ffa9f4f1b8f486cd6e835a1568c84","skills\u002Flinux\u002Fforensics\u002Fdisk\u002Ffilecarving\u002Fforemost\u002Fdetect","https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace","https:\u002F\u002Fgithub.com\u002FDCx7C5","#Python","2026-09-01 11:21:00",{"source":8,"skillName":5,"commands":64,"prompt":74,"zipAvailable":75},[65,68,71],{"tool":66,"command":67},"npx","npx skills add DCx7C5\u002Fai-marketplace --skill forensics-disk-filecarving-foremost-detect",{"tool":69,"command":70},"bunx","bunx skills add DCx7C5\u002Fai-marketplace --skill forensics-disk-filecarving-foremost-detect",{"tool":72,"command":73},"pnpm","pnpm dlx skills add DCx7C5\u002Fai-marketplace --skill forensics-disk-filecarving-foremost-detect","安装技能，技能地址：https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Flinux\u002Fforensics\u002Fdisk\u002Ffilecarving\u002Fforemost\u002Fdetect\u002FSKILL.md",true,[77],{"path":78,"resourceType":79,"resourceTypeDesc":80,"sizeBytes":81,"sourceHtmlUrl":82},"index.json","REFERENCE","参考文档",691,"https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Flinux\u002Fforensics\u002Fdisk\u002Ffilecarving\u002Fforemost\u002Fdetect\u002Findex.json",[84,106,127,147,169,185],{"skillNo":85,"name":86,"nameZh":6,"description":87,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":88,"categories":89,"keywords":90,"publishedAt":39},"01M71HAPZ01KQ30RKTB0FFSQ05","services-wmi-persistence-detect","Detect WMI event subscription persistence by enumerating ActiveScriptEventConsumer, CommandLineEventConsumer, and permanent subscriptions in the WMI repository.","https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fwindows\u002Fservices\u002Fwmi\u002Fpersistence\u002Fdetect\u002FSKILL.md",[],[91,21,92,93,94,34,95,96,97,98,99,100,101,102,103,104,22,36,105],"services","services wmi persistence detect","wmi","persistence","cm","process","activescript","event","subscriptions","commandline-consumer","repository","subscription","event-subscription","t1546.003","process-forensics",{"skillNo":107,"name":108,"nameZh":6,"description":109,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":110,"categories":111,"keywords":112,"publishedAt":39},"01M71HAK6JTTTS229T17WJMMCG","services-wmi-exec-exploit","Perform lateral movement across Windows networks using WMI-based remote execution techniques including Impacket wmiexec.py, CrackMapExec, and native WMI commands for stealthy post-exploitation during red team engagements.","https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fwindows\u002Fservices\u002Fwmi\u002Fexec\u002Fexploit\u002FSKILL.md",[],[113,91,114,93,115,116,117,36,35,118,119,120,121,122,34,123,124,33,125,126],"exploit","services wmi exec exploit","exec","remote","traffic","analysis","team","across","crackmapexec","native","command","lateral movement","lateral-movement","Impacket",{"skillNo":128,"name":129,"nameZh":6,"description":130,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":131,"categories":132,"keywords":133,"publishedAt":39},"01M71HAG6MHKNQV8KDZKMT4886","registry-artifact-extract","Extract and analyze Windows Registry hives to uncover user activity, installed software, autostart entries, and evidence of system compromise.","https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fwindows\u002Fregistry\u002Fartifact\u002Fextract\u002FSKILL.md",[],[134,135,136,137,138,139,36,35,140,118,141,142,34,33,143,144,31,145,146,30],"artifact","registry","registry artifact extract","extract","evidence-collection","artifact-analysis","collection","analyze","uncover","software","activity","windows-registry","regripper",{"skillNo":148,"name":149,"nameZh":6,"description":150,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":151,"categories":152,"keywords":153,"publishedAt":39},"01M71HACR4A8XTWTTSXK4124AA","processes-token-impersonate-detect","Detect Windows token impersonation and privilege abuse including SeImpersonatePrivilege exploitation via Potato attacks and token stealing techniques.","https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fwindows\u002Fprocesses\u002Ftoken\u002Fimpersonate\u002Fdetect\u002FSKILL.md",[],[21,154,155,156,157,158,159,95,160,36,105,161,162,163,164,165,166,167,168,34],"processes token impersonate detect","token","processes","attacks","windows","escalation","techniques","privilege-escalation","seimpersonate","token-impersonation","printspoofer","exploitation","potato","impersonation","via",{"skillNo":170,"name":171,"nameZh":6,"description":172,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":173,"categories":174,"keywords":175,"publishedAt":39},"01M71HAABSB4Z6QFSXEG00R4RK","processes-thread-injection-detect","Detect Windows thread injection techniques including CreateRemoteThread, QueueUserAPC, NtCreateThreadEx, and thread hijacking via process memory analysis.","https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fwindows\u002Fprocesses\u002Fthread\u002Finjection\u002Fdetect\u002FSKILL.md",[],[176,177,21,178,156,158,179,95,180,160,36,105,118,181,182,183,184,168,34,96],"thread","processes thread injection detect","injection","memory","process-injection","api","apc-injection","thread-injection","nt-api",{"skillNo":186,"name":187,"nameZh":6,"description":188,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":189,"categories":190,"keywords":191,"publishedAt":39},"01M71HA7H311V5G14WMX58HQSS","processes-hollow-technique-detect","Detect process hollowing (RunPE) by identifying processes with mismatched image paths between PEB and VAD tree, or unmapped PE headers in memory.","https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fwindows\u002Fprocesses\u002Fhollow\u002Ftechnique\u002Fdetect\u002FSKILL.md",[],[192,21,156,193,179,95,194,195,36,105,196,197,198,199,200,201,34,96,202,203],"processes hollow technique detect","tree","memory-forensics","process-hollow","peb","runpe","image","pe-header","in memory","with","mismatched","headers"]