Filesystem awareness in Klennet Carver

A file carver is supposed to be filesystem-agnostic. That is, the carving software is tailored to match file formats, not filesystems. It is not supposed to take any filesystem metadata into account, for the metadata may be missing, damaged, or incorrect.

Klennet Carver, however, has a concept of clusters. Clusters are the blocks of several consecutive sectors, used in filesystems to reduce management overhead. Klennet Carver does also require cluster sizes to be the power of two.

Working with clusters instead of sectors allows me to improve carving speed because number of possible combinations to work through decreases significantly. However, there are certain drawbacks:

  • Filesystems in which cluster sizes are not required to be a power of two cannot be analyzed properly. I can only think of one though, namely original HFS.
  • Complex configurations involving block-based RAID cannot be analyzed directly from disks if filesystem clusters are not aligned with RAID blocks (not sure how useful it can be anyway).
  • On tailpacking filesystems, tails of files most likely cannot be extracted. Tailpacking filesystems are rare in the wild, though (reiserFS maybe?).

Created 11 October, 2017

Updated 20 May 2018

I have a low volume mailing list, for news and tips, which I send out once or twice a month.
Subscribe if you are interested.