Resources provided for use by the DFIR community
Logical image of a 2GB volume taken from a USB, designed to be used to validate file carving tools.
ZIP archive contains:
- Raw volume image: Khyrenz-FileCarvingImage-USB-logical-2GB-formatted.dd
- Acquisition text file (generated by FTK Imager): Khyrenz-FileCarvingImage-USB-logical-2GB-formatted.001.txt
- List of files present in Unallocated Space: Khyrenz-FileCarvingImage-USB-logical-2GB-test_file_list.pdf
A selection of test files of varying file formats was collected or generated, and then copied onto a USB device, which had been formatted to contain a 2GB FAT16 volume. This volume was subsequently re-formatted using the built-in Windows ‘quick format’ process, in order to remove filesystem metadata.
A raw logical image of the USB device volume was generated using FTK Imager 4.