Forensic Images Used for NIST/CFTT File Carving Test Reports

Overview

This page contains links to dd images used for testing by CFTT of software applications with file carving capabilities. File carving is the practice of extracting files based on content, rather than on metadata. Extracting files from unallocated blocks is accomplished by identifying unique headers and footers associated with a specific file type.
Currently only images for carving graphic (jpg, gif, png, etc) files  and video files are available.

Graphic files

The dd images and layouts for graphic files can be down loaded from:

• Image and Layouts  in Linux bzip2/tar format
• Image files & layouts in Windows zip format 
  Note that these are 2 GB files, slow to download.

The dd files are constructed from the following graphic files:

• Original Files in Linux bzip2/tar format
• Original files in Windows zip format 

Video Files

The dd files for video files:

• Video dd files (bzip2/tar format)
• Video dd files (zip format)

The original video files used to construct the dd files:

• Original Files (bzip2/tar format)
• Original Files (zip format)

Test Images

A total of 8 dd images were created (for graphic files). Scripts for creating test images and analyzing test results:  Scripts (zip format)

Downloading the Test Images

The images are compressed with bzip2. To uncompress an image, run the bunzip2 program on the image. The command will look something like:
bunzip2 filename.bz2