Allegato "scalpel.conf"
Scarica# Scalpel configuration file # This configuration file controls the # types and sizes of files that are carved by Scalpel. Currently, # Scalpel can read Foremost 0.69 configuration files, but Scalpel # configuration files may not be backwards-compatible with Foremost. # In particular, maximum file carve size under Foremost 0.69 is 4GB, # while in the current version of Scalpel, it's 16EB (16 exabytes). # For each file type, the configuration file # describes the file's extension, whether the header and footer are # case sensitive, the maximum file size, and the header and footer for # the file. The footer field is optional, but header, size, case # sensitivity, and extension are required. Any line that begins with a # '#' is considered a comment and ignored. Thus, to skip a file type # just put a '#' at the beginning of that line # Headers and footers are decoded before use. To specify a value in # hexadecimal use \x[0-f][0-f] and for octal use \[0-3][0-7][0-7]. # Spaces can be represented by \s. Example: "\x4F\123\I\sCCI" decodes # to "OSI CCI". # To match any single character (aka a wildcard) use # a '?'. If you need to search for the '?' character, you will need to # change the 'wildcard' line *and* every occurrence of the old # wildcard character in the configuration file. ' # # Note: ?' is equal to 0x3f and \063. # # If you want files carved without filename extensions, # use "NONE" in the extension column. # The REVERSE keyword after a footer causes a search # backwards starting from [size] bytes beyond the location of the header # This is useful for files like PDFs that may contain multiple copies of # the footer throughout the file. When using the REVERSE keyword you will # extract bytes from the header to the LAST occurence of the footer (and # including the footer in the carved file). # # The NEXT keyword after a footer results in file carves that # include the header and all data BEFORE the first occurence of the # footer (the footer is not included in the carved file). If no # occurrence of the footer is discovered within maximum carve size bytes # from the header, then a block of the disk image including the header # and with length equal to the maximum carve size is carved. Use NEXT # when there is no definitive footer for a file type, but you know which # data should NOT be included in a carved file--e.g., the beginning of # a subsequent file of the same type. # # FORWARD_NEXT is the default carve type and this keyword may be # included after the footer, but is not required. For FORWARD_NEXT # carves, a block of data including the header and the first footer # (within the maximum carve size) are carved. If no footer appears # after the header within the maximum carve size, then no carving is # performed UNLESS the -b command line option is supplied. In this case, # a block of max carve size bytes, including the header, is carved and a # notation is made in the Scalpel log that the file was chopped. # To redefine the wildcard character, change the setting below and all # occurences in the formost.conf file. # #wildcard ? # case size header footer #extension sensitive # #--------------------------------------------------------------------- # EXAMPLE WITH NO SUFFIX #--------------------------------------------------------------------- # # Here is an example of how to use the no extension option. Any files # beginning with the string "FOREMOST" are carved and no file extensions # are used. No footer is defined and the max carve size is 1000 bytes. # # NONE y 1000 FOREMOST # #--------------------------------------------------------------------- # GRAPHICS FILES #--------------------------------------------------------------------- # # # AOL ART files # art y 150000 \x4a\x47\x04\x0e \xcf\xc7\xcb # art y 150000 \x4a\x47\x03\x0e \xd0\xcb\x00\x00 # # GIF and JPG files (very common) # gif y 5000000 \x47\x49\x46\x38\x37\x61 \x00\x3b # gif y 5000000 \x47\x49\x46\x38\x39\x61 \x00\x3b # jpg y 200000000 \xff\xd8\xff\xe0\x00\x10 \xff\xd9 # # # PNG # png y 20000000 \x50\x4e\x47? \xff\xfc\xfd\xfe # # # BMP (used by MSWindows, use only if you have reason to think there are # BMP files worth digging for. This often kicks back a lot of false # positives # # bmp y 100000 BM??\x00\x00\x00 # # TIFF # tif y 200000000 \x49\x49\x2a\x00 # TIFF # tif y 200000000 \x4D\x4D\x00\x2A # #--------------------------------------------------------------------- # ANIMATION FILES #--------------------------------------------------------------------- # # AVI (Windows animation and DiVX/MPEG-4 movies) # avi y 50000000 RIFF????AVI # # Apple Quicktime # These needles are based on the file command's magic. I don't # recommend uncommenting the 4th and 5th Quicktime needles unless # you're sure you need to, because they generate HUGE numbers of # false positives. # # mov y 10000000 ????moov # mov y 10000000 ????mdat # mov y 10000000 ????widev # mov y 10000000 ????skip # mov y 10000000 ????free # mov y 10000000 ????idsc # mov y 10000000 ????pckg # # MPEG Video # mpg y 50000000 \x00\x00\x01\xba \x00\x00\x01\xb9 # mpg y 50000000 \x00\x00\x01\xb3 \x00\x00\x01\xb7 # # Macromedia Flash # fws y 4000000 FWS # #--------------------------------------------------------------------- # MICROSOFT OFFICE #--------------------------------------------------------------------- # # Word documents # # # doc y 10000000 \xd0\xcf\x11\xe0\xa1\xb1\x1a\xe1\x00\x00 \xd0\xcf\x11\xe0\xa1\xb1\x1a\xe1\x00\x00 NEXT # doc y 10000000 \xd0\xcf\x11\xe0\xa1\xb1 # # Outlook files # pst y 500000000 \x21\x42\x4e\xa5\x6f\xb5\xa6 # ost y 500000000 \x21\x42\x44\x4e # # Outlook Express # dbx y 10000000 \xcf\xad\x12\xfe\xc5\xfd\x74\x6f # idx y 10000000 \x4a\x4d\x46\x39 # mbx y 10000000 \x4a\x4d\x46\x36 # #--------------------------------------------------------------------- # WORDPERFECT #--------------------------------------------------------------------- # # wpc y 1000000 ?WPC # #--------------------------------------------------------------------- # HTML #--------------------------------------------------------------------- # # htm n 50000 <html </html> # #--------------------------------------------------------------------- # ADOBE PDF #--------------------------------------------------------------------- # # pdf y 5000000 %PDF %EOF\x0d REVERSE # pdf y 5000000 %PDF %EOF\x0a REVERSE # #--------------------------------------------------------------------- # AOL (AMERICA ONLINE) #--------------------------------------------------------------------- # # AOL Mailbox # mail y 500000 \x41\x4f\x4c\x56\x4d # # # #--------------------------------------------------------------------- # PGP (PRETTY GOOD PRIVACY) #--------------------------------------------------------------------- # # PGP Disk Files # pgd y 500000 \x50\x47\x50\x64\x4d\x41\x49\x4e\x60\x01 # # Public Key Ring # pgp y 100000 \x99\x00 # Security Ring # pgp y 100000 \x95\x01 # pgp y 100000 \x95\x00 # Encrypted Data or ASCII armored keys # pgp y 100000 \xa6\x00 # (there should be a trailer for this...) # txt y 100000 -----BEGIN\040PGP # # #--------------------------------------------------------------------- # RPM (Linux package format) #--------------------------------------------------------------------- # rpm y 1000000 \xed\xab # # #--------------------------------------------------------------------- # SOUND FILES #--------------------------------------------------------------------- # # wav y 200000 RIFF????WAVE # # Real Audio Files # ra y 1000000 \x2e\x72\x61\xfd # ra y 1000000 .RMF # #--------------------------------------------------------------------- # WINDOWS REGISTRY FILES #--------------------------------------------------------------------- # # Windows NT registry # dat y 4000000 regf # Windows 95 registry # dat y 4000000 CREG # # #--------------------------------------------------------------------- # MISCELLANEOUS #--------------------------------------------------------------------- # # zip y 10000000 PK\x03\x04 \x3c\xac # # java y 1000000 \xca\xfe\xba\xbe # #--------------------------------------------------------------------- # ScanSoft PaperPort "Max" files #--------------------------------------------------------------------- # max y 1000000 \x56\x69\x47\x46\x6b\x1a\x00\x00\x00\x00 \x00\x00\x05\x80\x00\x00 #--------------------------------------------------------------------- # PINs Password Manager program #--------------------------------------------------------------------- # pins y 8000 \x50\x49\x4e\x53\x20\x34\x2e\x32\x30\x0d
Allegati
Per riferirsi agli allegati di una pagina, usare attachment:NOME_FILE, come mostrato qui sotto nell'elenco degli allegati. NON usare l'URL che si trova in corrispondenza del collegamento [scarica], potrebbe cambiare in futuro.Non รจ consentito inserire allegati su questa pagina.
