The following Custom Carver files are for use with AccessData’s Forensic Toolkit® program. A Custom Carver file will carve for any file type that has the correct header/footer/file length information. FTK Custom Carver’s can find any embedded or deleted file as long as the file header still exists.

The Custom Carver files available from AccessData have been collected from both internal and external sources*. Each of these files has been reviewed by AccessData for basic functionality ONLY. Since every investigation varies, we cannot guarantee that these Custom Carvers will recover all of the data files you are targeting. AccessData recommends that you review the Custom Carver files intended output prior to using it in a case or relying on it as the basis for any professional opinion.

Creating and managing Custom Carvers is covered in the AccessData BootCamp training classes. Please contact your sales representative for more information.

CUSTOM CARVERS:

Linux Carvers
Macintosh Carvers
Mobile Device Carvers
Windows Carvers
Other Carvers

Disclaimer

As with most Custom Carver functionality, this information is based upon the author’s research. While described behavior has been found to be consistent, different platforms or software versions may produce different results. Anyone with additional information or differing behavior is urged to contact the author so that updates and additional research can be conducted.

Installation

To install a specific Custom Carver file for use in FTK, you simply download the file to your computer. In the FTK Case Manager select Manage > Carvers. In the Manage Shared Custom Carvers dialog, click Import. Each carver must be imported individually.

Use

Once a particular Custom Carver file is installed, you can select it during the selection of preprocessing options or from

Additional Analysis > Data Carving in FTK.

* Custom Carvers have been developed in association with the students and faculty of the Marshall University Department of Integrated Science and Technology and the Marshall University Forensic Science Center.