autopsy icon indicating copy to clipboard operation
autopsy copied to clipboard

Adding CR3 carving

Open DRCRecoveryData opened this issue 10 months ago • 2 comments

Hi,

Can you adding CR3 Canon file signature for Carving?

DRCRecoveryData avatar Jan 23 '25 07:01 DRCRecoveryData

Instructions for adding custom file signatures to photo rec which is what Autopsy uses for file carving can be found here https://sleuthkit.org/autopsy/docs/user-docs/4.21.0/photorec_carver_page.html#:~:text=To%20add%20custom%20file%20signatures,only%20the%20specified%20types%22%20option.

markmckinnon avatar Jan 23 '25 16:01 markmckinnon

Instructions for adding custom file signatures to photo rec which is what Autopsy uses for file carving can be found here https://sleuthkit.org/autopsy/docs/user-docs/4.21.0/photorec_carver_page.html#:~:text=To%20add%20custom%20file%20signatures,only%20the%20specified%20types%22%20option.

CR3 is more complex by:

https://github.com/WojciechMula/recovercr3/blob/master/recovercr3.py

DRCRecoveryData avatar Jan 24 '25 08:01 DRCRecoveryData