MediaCarve - a new tool for media file recovery

[CarmineCella]

Hi all,

I'd like to introduce a new tool that I developed for media file carving and recovery: MediaCarve.
It's open-source command-line tool and it's released for OSX and Linux; you can find it here:

http://www.mediacarve.com


I'd be pleased to have your comments and suggestions.
Thanks, Carmine

[HaQue]

Hi, Thanks for sharing. I like the approach of small targeted tools that focus on a specific set of functions.

One thing may be to explain some of the switches and possibly give examples.

One may not know what "jump size for reading (undersampling)" is, or "-s <size> skipped amount of byte(s)" means.

for the switch "-d <fmt> disable the specified format" it may benefit to explain if you can disable multiple formats, and if so, the syntax.

-for "o <dir> alternative output folder (must exist). " Maybe you could provide an option to create the folder if it doesn't exist? I find it frustrating if I run a tool and forget to crate a folder, and have to either leave the tool, create it, then start over, or switch windows.

I think it is a very useful addition to tools as a lot of DR is to get back media formats.

Thanks again

[CarmineCella]

Hi HaQue,

thanks a lot for your reply. You're right, the options are not clearly explained so I'll rework a bit the homepage of MediaCarve to improve this aspect. In the meantime, I'll try to give you some explanations:

1. options -j (jump): as you know file carving can be really slow; so, if you specify, say, -j100 the MediaCarve will check your disk every 100 bytes (loosing all the bytes in between) thus undersampling
the research. This is not really solid in term of results but can improve a lot the speed of the process

2. options -s (skip): I quote the FAQ page www.mediacarve.com/faq.html hope this will help

Q. Recovering a 1TB data is pretty slow; can I stop the session and restart it later?
A. Sure. Just hit Ctrl-C and MediaCarve will stop telling you which is the last location examined. You can then start again MediaCarve specifying the starting point with the option -s.

3. option -d <fmt>: this option can be used to disable the research of some format; again, you should do this for speed reason: the more you search, the slower MediaCarve will go. So, if you want disable a couple of formats, then, you can specify the options several times. For example:

./mediacarve -dbmp -dmp3 -djpg /dev/disk1

will disable the search for bmp, mp3 and jpg files.

4. option -o <dir>: you're totally right; I will modify the option so that if the folder does not exist it will be created.


Thanks a lot for you feedback!! Don't hesitate to ask me more, your help is very welcome.

Best, Carmine

[pclab]

I have a SD card to try to recover.
I'll give this a shot.
Thanks