Overview
This page contains links to dd images for the use of testing software applications with file carving capabilities. File carving is the practice of extracting files based on content, rather than on metadata. Extracting files from unallocated blocks is accomplished by identifying unique headers and footers associated with a specific file type.
Image Creation
For each image created there are six different levels, where each level represents a different scenario of fragmentation.
Five different file types were used to create the images.
A link to the un-fragmented files used to populate the thumb drive is provided below. This provides a comparison to determine how well a tool performs carving on different file types for each level of fragmentation.
Test Images
A total of 30 images were created. Each image contained no more than 10 files of a specific type. The files contained within an image are documented as such: file size, start sector, end sector.
The naming convention for the images is LEVEL_Filetype.dd.
The images are compressed with bzip2. To uncompress an image, run the bunzip2 program on the image. The command will look something like:
bunzip2 L0_Graphic.dd.bz2
The uncompressed file is then L0_Graphic.dd.
Of course, bunzip2 runs in a Linux environment. After uncompressing, the image file can be moved to another operating system where the tool under test is located.
Image |
Description |
File Types |
Non-fragmented graphics files |
JPG,PNG,BMP,GIF,TIF,PCX |
|
Sequentially fragmented graphics files |
JPG,PNG,BMP,GIF,TIF,PCX |
|
Non-sequentially fragmented graphics files |
JPG,PNG,BMP,GIF,TIF,PCX |
|
Graphics files with missing fragments |
JPG,PNG,BMP,GIF,TIF,PCX |
|
Graphics files nested within graphics files |
JPG,PNG,BMP,GIF,TIF,PCX |
|
Braided graphics files |
JPG,PNG,BMP,GIF,TIF,PCX |
|
Non-fragmented document files |
DOC, XLS, PPT, PDF |
|
Sequentially fragmented document files |
DOC, XLS, PPT, PDF |
|
Non-sequentially fragmented document files |
DOC, XLS, PPT, PDF |
|
Document files with missing fragments |
DOC, XLS, PPT, PDF |
|
Document files nested in document files |
DOC, XLS, PPT, PDF |
|
Braided document files |
DOC, XLS, PPT, PDF |
|
Non-fragmented archive files |
7Z,BZ2,GZ,TAR,WIM,RAR,ZIP |
|
Sequentially fragmented archive files |
7Z,BZ2,GZ,TAR,WIM,RAR,ZIP |
|
Non-Sequentially fragmented archive files |
7Z,BZ2,GZ,TAR,WIM,RAR,ZIP |
|
Archive files with missing fragments |
7Z,BZ2,GZ,TAR,WIM,RAR,ZIP |
|
Archive files nested in archive files |
7Z,BZ2,GZ,TAR,WIM,RAR,ZIP |
|
Braided archive files |
7Z,BZ2,GZ,TAR,WIM,RAR,ZIP |
|
Non-Fragmented audio files |
MP3,WAV,AU,WMA |
|
Sequentially fragmented audio files |
MP3,WAV,AU,WMA |
|
Non-Sequentially fragmented audio files |
MP3,WAV,AU,WMA |
|
Audio files with missing fragments |
MP3,WAV,AU,WMA |
|
Audio files nested in audio files |
MP3,WAV,AU,WMA |
|
Braided audio files |
MP3,WAV,AU,WMA |
|
Non-Fragmented video files |
MP4,AVI,MOV,FLV,MPG,WMV |
|
Sequentially fragmented video files |
MP4,AVI,MOV,FLV,MPG,WMV |
|
Non-sequentially fragmented video files |
MP4,AVI,MOV,FLV,MPG,WMV |
|
Video files with missing fragments |
MP4,AVI,MOV,FLV,MPG,WMV |
|
Video files nested in video files |
MP4,AVI,MOV,FLV,MPG,WMV |
|
Braided video files |
MP4,AVI,MOV,FLV,MPG,WMV |