Question

How can I carve a section of data/HEX using Imager?

 

Answer

  1. Open Imager
  2. Go to File > Add Evidence Item and select the source image or file
  3. Use the Evidence Tree and File List to select the level or file from which you wish to carve
  4. In the HEX view, put your cursor at the position you wish to start carving from (the lower-left will tell you the cursor's position)
  5. Right-click in the HEX view and select Set Selection Length
  6. Input the desired length, in Decimal or HEX Bytes, that you wish to carve and click OK (the lower-left will show the selection start and length)

  7. In the HEX view, right-click the highlighted HEX and select Save Selection (save the selection with the file extension you desire)

 

Overview

 

Using Imager to carve data may be helpful in extracting specific files or when only a portion of an image is needed.