File headers


Sep 15, 2008
27
0
#1
I was wondering is there a list of file headers and footers. my friends flash drive crashed and he wants me to recovery some files but i don't know the headers or footers for some or if they even have standard footers I know BMP files don't i don't think word files do either but how do you find the size of the file for a word document is it the same as with the BMP files or is it different?
 

uzdcar

New Member
Jan 12, 2009
42
0
#2
There are several decent resources on the Internet. Use "magic numbers" in your search term as well as more specific information. MS docs have several different headers and footers, but most of the Office 2007 products share the same. Here's just one source that I often rely on:
www .garykessler.net/library/file_sigs.html
Also, keep in mind that carving out files can get difficult if the file isn't contiguous (i.e. you can't just carve out X bytes from the start of the file). Tools like WinHex, FTK, and EnCase are very helpful for this.
 

Complete

Administrator
Aug 19, 2006
861
0
#3
Yes, check out Winhex as it does have a decent carving function. There is a list of file headers within the program.

Also try PhotoRec - a very nice tool as well.
 

dccfguru

New Member
Jul 19, 2008
6
0
#4
If you have access to a Linux box, you can download foremost from the SourceForge.net website. There is a config file within the program that will give you a fantastic starting point for various file headers and footers.
 

About us

  • Our community began in 2004. Since this time, we have grown to have over 29,000+ members within the DFIR & Cyber Security community.

    We are happy to announce that this forum is now under new ownership with the goal to once again become the main Digital Forensics Forum on the internet for DFIR, OSINT and Cyber Security.

    If you can think of ways to help us improve, please let us know.

    We pride ourselves on offering unbiased, critical discussion among people of all different backgrounds.

    We are working every day to make sure our community is one of the best.

Quick Navigation

User Menu