Simple Carver Suite Toolset Listing This is a current listing of all tools within Simple Carver Suite in alphabetical order, last updated on 24 April 2011. Tool 1 of 66 ABCthumbs Extractor is a tool designed to view and extract information contained within the ABC Viewer thumbnail cache file created by the picture previewing software ABC Viewer. The thumbnail cache file can contain file name, file properties and thumbnail picture information. Useful for use in forensic examinations as forensic software or data recovery. All extracted information from the ABC Viewer thumbnail cache file can be extracted and saved to disk. Simple Carver Suite: forensic software, data recovery & ediscovery software Tool 2 of 66 Archive View has been designed to quickly access and review archive file types using a convenient Explorer style interface. The following formats are supported: Zip, Zip Sfx, Split Zip, Jar, Jar Sfx, Cab, Lha, Lha Sfx, Lzh, Lzh Sfx,Tar, GZip, Bh (BlakHole), Bh Sfx , Rar, Rar Sfx, Arj, Arj Sfx, Arc, Arc Sfx, Ace, Ace Sfx, Zoo, GZipTar, Tz, Taz, Tgz compressed files and UUE/XXE/ENC encoded files. Simple Carver Suite: forensic software, data recovery & ediscovery software Tool 3 of 66 Average Filesizes is a tool designed to calculate the average size of user specified files or file types. Useful for working out a suitable carve size for a specific file type. A user can supply the program with a sample of files and the program will automatically calculate and display the average recovery size on screen. Simple Carver Suite: forensic software, data recovery & ediscovery software Tool 4 of 66 Base 64 Decoder is a utility added to the suite for decoding base 64 encoded file(s) and folder(s). Support is included for single or multiple file base 64 decoding. Useful for decoding live or recovered base 64 email attachments from email messages. Useful for use in forensic examinations as forensic software or data recovery. Simple Carver Suite: forensic software, data recovery & ediscovery software Tool 5 of 66 Byte Swapper is a research utility added to the suite for altering the content of a file. It does this by reordering the byte order of a file, either nibble or word swapping can be applied. Simple Carver Suite: forensic software, data recovery & ediscovery software Tool 6 of 66 Chrome Thumbs Extractor is a utility designed to extract images and associated file information from the thumbnail database produced and utilised by Google Chrome Internet Browser. Chrome uses this database to store thumbnails of visited websites. Average Filesizes is a tool designed to calculate the average size of user specified files or file types. Useful for working out a suitable carve size for a specific file type. A user can supply the program with a sample of files and the program will automatically calculate and display the average recovery size on screen. Simple Carver Suite: forensic software, data recovery & ediscovery software Tool 4 of 66 Base 64 Decoder is a utility added to the suite for decoding base 64 encoded file(s) and folder(s). Support is included for single or multiple file base 64 decoding. Useful for decoding live or recovered base 64 email attachments from email messages. Useful for use in forensic examinations as forensic software or data recovery. Simple Carver Suite: forensic software, data recovery & ediscovery software Tool 5 of 66 Byte Swapper is a research utility added to the suite for altering the content of a file. It does this by reordering the byte order of a file, either nibble or word swapping can be applied. Simple Carver Suite: forensic software, data recovery & ediscovery software Tool 6 of 66 Chrome Thumbs Extractor is a utility designed to extract images and associated file information from the thumbnail database produced and utilised by Google Chrome Internet Browser. Chrome uses this database to store thumbnails of visited websites. Useful for use in forensic examinations as forensic software or data recovery. All extracted information from the Google Chrome thumbnail cache file can be extracted and saved to disk. Simple Carver Suite: forensic software, data recovery & ediscovery software Tool 7 of 66 Contacts.edb Extractor is a forensic software tool designed to extract information contained within the Windows Live Messenger (WLM) contacts file (contacts.edb) file. The contacts.edb file can contain names, usernames, aliases, email addresses and file property information stored and utilised by the Windows Live Messenger program. All extracted information from the contacts.edb file is saved and presented as a series of csv (comma separated value) files for maximum flexibility. Simple Carver Suite: forensic software, data recovery & ediscovery software Tool 8 of 66 Create Folders is a utility designed to reduce repetitive folder creation tasks. Template folder structures can be created and saved using a tree style display, at the click of a button an entire folder structure can be generated at a user specified location. Templates can be distributed with other users allowing groups of individuals to produce standard folder structures for a number of purposes suitable for e-Discovery and repetitive file management tasks. Simple Carver Suite: forensic software, data recovery & ediscovery software Tool 9 of 66 CSV2HTML is a useful utility for quickly converting CSV (comma separated value files) to HTML formatted files. Includes basic HTML format options and CSV input options. Useful for use in forensic examinations or data recovery. Simple Carver Suite: forensic software, data recovery & ediscovery software Tool 10 of 66 Delete Empty Files is a utility added to the suite for deleting empty files within a specified folder(s). Some data recovery techniques and other processes can produce an unwanted number of empty files this tool will identify and remove these files. Simple Carver Suite: forensic software, data recovery & ediscovery software Tool 11 of 66 Disk List is a utility used to display physical disks connected to a computer, disk geometry information is also displayed, the details of which can be quickly saved to disk as a text file. Simple Carver Suite: forensic software, data recovery & ediscovery software Tool 12 of 66 Disk Map is a utility added to the suite for creating images for validation testing or for research and development purposes including file carving exercises. Utilising a pre-prepared sterile image of a floppy diskette (FAT file system) and a graphical display representing freespace, images can be developed quickly. These images can be used for both teaching and validation purposes for use with forensic software and data recovery tools. Detailed reports are produced with every image created detailing data locations. Download: Disk Map Example Image Simple Carver Suite: forensic software, data recovery & ediscovery software Tool 13 of 66 Drive Harvest is unique to Simple Carver Suite, a tool which will recurse through a user specified folder or volume and gather all file and folder listings. Multiple folders/volumes can be added to a single database. The process takes a couple of minutes to complete. All information is stored in a single compact database file which can be viewed at any time once processing is complete. The database can be searched and records filtered using powerful SQL query language. This tool will quickly assist a user in identifying user activity on a computer. Listings and search results can be saved to HTML, CSV or Text file for reporting purposes. Useful for use in forensic examinations as forensic software or data recovery. Simple Carver Suite: forensic software, data recovery & ediscovery software Tool 14 of 66 Edit File times is a utility designed to allow a user to modify file created, last modified and last accessed file date time stamps. Individual or multiple files/folders can be processed. Useful for research and testing purposes. Simple Carver Suite: forensic software, data recovery & ediscovery software Tool 15 of 66 Eml2HTML is an email file processor used to convert standard MIME email messages into HTML format, this process speeds up review time and works on email messages from Microsoft Vista and Macintosh OSX (.eml and emlx) and other packages utilising this standard format. Folders (inculding sub folders) are selected by the user. Message body, header information and file attachment information can be extracted during this process. The converted output is ready to save onto compact disc or other device and can be read on most computer systems with internet browser software installed. Simple Carver Suite: forensic software, data recovery & ediscovery software Tool 16 of 66 EXE Extractor is a forensic software utility designed to extract all version information which may be present within an executable or library file. This information can be used to provide a quick indication or overview of program(s) installed on a computer system. All information processed can be readily exported into a report for detailed review. Simple Carver Suite: forensic software, data recovery & ediscovery software Tool 17 of 66 File Lister is a utility designed to search and filter files and folders by filename and/or extension. Utilising both wildcard support and regular expressions File Lister will identify files based on your search criteria. In addition you can specify files to exclude or include during a search. Results can be saved to CSV format for processing with additional software as required. Simple Carver Suite: forensic software, data recovery & ediscovery software Tool 18 of 66 Filecat is a forensic software tool that can be used in eDiscovery, the tool reads all files contained within selected disk volume (s), each file is examined and categorised. The output can be saved in both tabular and graphical format. Filecat file identification settings are 100% user configurable. All files are categorised using search criteria specified by the user, files are examined based on file header and file extension.