Resources provided for use by the DFIR community
Logical image of a 2GB volume taken from a USB, designed to be used to validate file carving tools.
ZIP archive contains:
- Raw volume image: Khyrenz-FileCarvingImage-USB-logical-2GB-formatted.dd
- Acquisition text file (generated by FTK Imager): Khyrenz-FileCarvingImage-USB-logical-2GB-formatted.001.txt
- List of files present in Unallocated Space: Khyrenz-FileCarvingImage-USB-logical-2GB-test_file_list.pdf
A selection of test files of varying file formats was collected or generated, and then copied onto a USB device, which had been formatted to
contain a 2GB FAT16 volume. This volume was subsequently re-formatted using the built-in Windows ‘quick format’ process, in order to remove filesystem metadata.
A raw logical image of the USB device volume was generated using FTK Imager 4.
ZIP hashes:
MD5: 7de6d9aa72948184487b558df4aa9a9a
SHA-1: 24cf57902a1b218cc22b43c38a761cd7fd49449e
SHA-256: b60f0ef79a21e3bead194c61d72e420acf3d8f4830ed1139b9c6b1c1ab4ffc5f