Phone Image Carver

File Carving, Data Carving, or just Carving is a general term for extracting data (files) out of raw data, much like "carving" a sculpture from a stone.

It is the practice of searching for files based on internal content, rather than known information such as that supplied by a file system. File carving is a powerful tool for recovering files and fragments of files when a file system is not present, damaged, corrupt, or unknown.

File Carving works by looking for file headers and footers, and then "carving out" the blocks between these two boundaries. Additional accuracy is achieved by analysis of the contents of identified files to assess if internal structure conforms with the identified file type.

Is specifically designed for cell phone forensics. It does not search on sector boundaries, but analyses your phone image file sector by sector for user select file types.

Do you create mobile phone hex dumps in forensic phone examinations?
• What file types are you data carving from your forensic phone dumps?
• Are your file carving scripts accurate for more than 300 different file types?
• Do you need a reliable sector file carving tool to quickly scan your cell phone image files?

Does your suspect store .jpeg, .png, .tiff, files on a phone? Find out in 3 simple steps:
• Select image file;
• Select file types to data carve;
• Scan and preview the search results.

Flashing or dumping a cell phone describes creating either a hexadecimal or binary image file of cell phone memory. The procedure follows the established principals of computer forensics where a forensics technician strives to preserve original evidence in a manner which will demonstrate integrity and continuity to a court.

The additional benefit of the hex dumping methodology when compared to real time query based phone analysis is that it allows for the examination of hidden or deleted data within the image file.