Forensic Images Used for NIST/CFTT File Carving Test Reports

Overview

This page contains links to dd images used for testing by CFTT of software applications with file carving capabilities. File carving is the practice of extracting files based on content, rather than on metadata. Extracting files from unallocated blocks is accomplished by identifying unique headers and footers associated with a specific file type.
Currently only images for carving graphic (jpg, gif, png, etc) files  and video files are available.

Graphic files

Image and Layouts  in Linux bzip2/tar format
Image files & layouts in Windows zip format
Note that these are 2 GB files, slow to download.

The dd files are constructed from the following graphic files:

Original Files in Linux bzip2/tar format
Original files in Windows zip format

Video Files

The dd files for video files:

Video dd files (bzip2/tar format)
Video dd files (zip format)

Original Files (bzip2/tar format)
Original Files (zip format)

Test Images

A total of 8 dd images were created (for graphic files). Scripts for creating test images and analyzing test results:  Scripts (zip format)

The images are compressed with bzip2. To uncompress an image, run the bunzip2 program on the image. The command will look something like:
bunzip2 filename.bz2