scalpel 1.60-1build1 / etc / scalpel / scalpel.conf

# Scalpel configuration file 

# This configuration file controls the
# types and sizes of files that are carved by Scalpel.  Currently,
# Scalpel can read Foremost 0.69 configuration files, but Scalpel
# configuration files may not be backwards-compatible with Foremost.
# In particular, maximum file carve size under Foremost 0.69 is 4GB,
# while in the current version of Scalpel, it's 16EB (16 exabytes).  

# For each file type, the configuration file
# describes the file's extension, whether the header and footer are
# case sensitive, the maximum file size, and the header and footer for
# the file. The footer field is optional, but header, size, case
# sensitivity, and extension are required.  Any line that begins with a
# '#' is considered a comment and ignored. Thus, to skip a file type
# just put a '#' at the beginning of that line

# Headers and footers are decoded before use. To specify a value in
# hexadecimal use \x[0-f][0-f] and for octal use \[0-3][0-7][0-7].
# Spaces can be represented by \s. Example: "\x4F\123\I\sCCI" decodes
# to "OSI CCI".  # To match any single character (aka a wildcard) use
# a '?'. If you need to search for the '?' character, you will need to
# change the 'wildcard' line *and* every occurrence of the old
# wildcard character in the configuration file. '
#
# Note: ?' is equal to 0x3f and \063. 
#
# If you want files carved without filename extensions, 
# use "NONE" in the extension column.

# The REVERSE keyword after a footer causes a search
# backwards starting from [size] bytes beyond the location of the header
# This is useful for files like PDFs that may contain multiple copies of 
# the footer throughout the file.  When using the REVERSE keyword you will
# extract bytes from the header to the LAST occurence of the footer (and
# including the footer in the carved file).
#
# The NEXT keyword after a footer results in file carves that
# include the header and all data BEFORE the first occurence of the
# footer (the footer is not included in the carved file).  If no
# occurrence of the footer is discovered within maximum carve size bytes
# from the header, then a block of the disk image including the header
# and with length equal to the maximum carve size is carved.  Use NEXT
# when there is no definitive footer for a file type, but you know which
# data should NOT be included in a carved file--e.g., the beginning of
# a subsequent file of the same type.
#
# FORWARD_NEXT is the default carve type and this keyword may be 
# included after the footer, but is not required.  For FORWARD_NEXT
# carves, a block of data including the header and the first footer 
# (within the maximum carve size) are carved.  If no footer appears
# after the header within the maximum carve size, then no carving is
# performed UNLESS the -b command line option is supplied.  In this case,
# a block of max carve size bytes, including the header, is carved and a
# notation is made in the Scalpel log that the file was chopped.

# To redefine the wildcard character, change the setting below and all
# occurences in the formost.conf file.
#
#wildcard  ?

#		case	size	header			footer
#extension   sensitive	
#
#---------------------------------------------------------------------
# EXAMPLE WITH NO SUFFIX
#---------------------------------------------------------------------
#
# Here is an example of how to use the no extension option. Any files 
# beginning with the string "FOREMOST" are carved and no file extensions
# are used. No footer is defined and the max carve size is 1000 bytes.
#
#      NONE     y      1000     FOREMOST
#
#---------------------------------------------------------------------
# GRAPHICS FILES
#---------------------------------------------------------------------	
#
#
# AOL ART files
#	art	y	150000	\x4a\x47\x04\x0e	\xcf\xc7\xcb
#  	art	y 	150000	\x4a\x47\x03\x0e	\xd0\xcb\x00\x00
#
# GIF and JPG files (very common)
#	gif	y	5000000		\x47\x49\x46\x38\x37\x61	\x00\x3b
#  	gif	y 	5000000		\x47\x49\x46\x38\x39\x61	\x00\x3b
# 	jpg	y	200000000	\xff\xd8\xff\xe0\x00\x10	\xff\xd9
#
#
# PNG   
#  	png	y	20000000	\x50\x4e\x47?	\xff\xfc\xfd\xfe
#
#
# BMP 	(used by MSWindows, use only if you have reason to think there are
#      	BMP files worth digging for. This often kicks back a lot of false
#	positives
#
#	bmp	y	100000	BM??\x00\x00\x00
#
# TIFF
#  	tif	y	200000000	\x49\x49\x2a\x00
# TIFF
#	tif	y	200000000	\x4D\x4D\x00\x2A
#
#---------------------------------------------------------------------	
# ANIMATION FILES
#---------------------------------------------------------------------	
#
# AVI (Windows animation and DiVX/MPEG-4 movies)
#  	avi	y	50000000 RIFF????AVI
#
# Apple Quicktime
#   These needles are based on the file command's magic.  I don't
#   recommend uncommenting the 4th and 5th Quicktime needles unless 
#   you're sure you need to, because they generate HUGE numbers of 
#   false positives.
#
#	mov	y	10000000	????moov
#	mov	y	10000000	????mdat
#	mov	y	10000000	????widev
#	mov	y	10000000	????skip
#	mov	y	10000000	????free
#	mov	y	10000000	????idsc
#	mov	y	10000000	????pckg
#
# MPEG Video
#	mpg	y	50000000	\x00\x00\x01\xba	\x00\x00\x01\xb9
#	mpg     y 	50000000	\x00\x00\x01\xb3	\x00\x00\x01\xb7
#
# Macromedia Flash
#	fws	y	4000000	FWS
#
#---------------------------------------------------------------------	
# MICROSOFT OFFICE 
#---------------------------------------------------------------------	
#
# Word documents
#
#
#	doc	y	10000000  \xd0\xcf\x11\xe0\xa1\xb1\x1a\xe1\x00\x00 \xd0\xcf\x11\xe0\xa1\xb1\x1a\xe1\x00\x00 NEXT
#	doc	y	10000000  \xd0\xcf\x11\xe0\xa1\xb1
#
# Outlook files
#	pst	y	500000000	\x21\x42\x4e\xa5\x6f\xb5\xa6
#	ost	y	500000000 	\x21\x42\x44\x4e
#
# Outlook Express
#	dbx	y	10000000	\xcf\xad\x12\xfe\xc5\xfd\x74\x6f
#	idx	y	10000000	\x4a\x4d\x46\x39
#	mbx	y	10000000	\x4a\x4d\x46\x36
#
#---------------------------------------------------------------------	
# WORDPERFECT
#---------------------------------------------------------------------
#
#	wpc	y	1000000	?WPC
#
#---------------------------------------------------------------------	
# HTML
#---------------------------------------------------------------------	
#
#	htm	n	50000   <html			</html>
#
#---------------------------------------------------------------------	
# ADOBE PDF
#---------------------------------------------------------------------	
#
#	pdf	y	5000000	%PDF  %EOF\x0d	REVERSE
#	pdf	y	5000000	%PDF  %EOF\x0a	REVERSE
#
#---------------------------------------------------------------------	
# AOL (AMERICA ONLINE)
#---------------------------------------------------------------------	
#
# AOL Mailbox
#	mail	y	500000	 \x41\x4f\x4c\x56\x4d
#
#
#	
#---------------------------------------------------------------------	
# PGP (PRETTY GOOD PRIVACY)
#---------------------------------------------------------------------	
#
# PGP Disk Files
#	pgd	y	500000	\x50\x47\x50\x64\x4d\x41\x49\x4e\x60\x01
#
# Public Key Ring
#	pgp	y	100000	\x99\x00
# Security Ring
#	pgp	y	100000	\x95\x01
#	pgp	y	100000	\x95\x00
# Encrypted Data or ASCII armored keys
#	pgp	y	100000	\xa6\x00
# (there should be a trailer for this...)
#	txt	y	100000	-----BEGIN\040PGP
#
#
#---------------------------------------------------------------------	
# RPM (Linux package format)
#---------------------------------------------------------------------	
#	rpm	y	1000000	\xed\xab
#
#
#---------------------------------------------------------------------	
# SOUND FILES
#---------------------------------------------------------------------	
#
#	wav     y	200000	RIFF????WAVE
#
# Real Audio Files
#	ra	y	1000000	\x2e\x72\x61\xfd
#	ra	y	1000000	.RMF
#
#---------------------------------------------------------------------	
# WINDOWS REGISTRY FILES
#---------------------------------------------------------------------	
# 
# Windows NT registry
#	dat	y	4000000	regf
# Windows 95 registry
#	dat	y	4000000	CREG
#
#
#---------------------------------------------------------------------	
# MISCELLANEOUS
#---------------------------------------------------------------------	
#
#	zip	y	10000000	PK\x03\x04	\x3c\xac
#
#	java	y	1000000	\xca\xfe\xba\xbe
#
#---------------------------------------------------------------------	
# ScanSoft PaperPort "Max" files
#---------------------------------------------------------------------	
#      max   y     1000000    \x56\x69\x47\x46\x6b\x1a\x00\x00\x00\x00   \x00\x00\x05\x80\x00\x00 
#---------------------------------------------------------------------	
# PINs Password Manager program
#---------------------------------------------------------------------	
#      pins  y     8000     \x50\x49\x4e\x53\x20\x34\x2e\x32\x30\x0d