IPED icon indicating copy to clipboard operation
IPED copied to clipboard

Resume.dat entry carver and parser

Open wladimirleite opened this issue 8 months ago • 0 comments

Recently a carver for the torrent client "resume.dat" file was added (#1985). However, working on a real case, the carved resume.dat's did not help that much. Digging a bit deeper, I "manually" found in the unallocated space a few "resume.dat" entries (i.e. not the whole file, but some of its records) with the information I was looking for. In such cases, the "resume.dat" file header (which is used to carve it) was overwritten, but some of its records were still there.

wladimirleite avatar May 30 '24 21:05 wladimirleite