Selective File Dumper (SFDumper) is a free open source computer forensics tool, written by Nanni Bassetti and Denis Frati, for Linux systems.
It is a Bash script which can retrieve all the files of a chosen type (e.g. .doc or .jpg), regardless if they are active, deleted or unallocated. It automatically runs Foremost for carving, and Sleuthkit for deleted files retrieval. It then eliminates duplicated files by comparing the SHA256 hashes of the carved files and the active and deleted files. Thanks to carving, files simply renamed to a different extension will be identified. Also, it is possible to expand the Foremost configuration file inside the script to add new extensions. Finally, it is possible to do a keyword search on the extracted files. The script can work on an image file or directly from a device.
It is free software licensed under the terms of the GNU General Public License (GPL) and GNU Lesser General Public License (LGPL).
Read more about Selective File Dumper: Requirements
Famous quotes containing the words selective and/or file:
“The selective memory isn’t selective enough.”
—Blake Morrison (b. 1950)
“A common and natural result of an undue respect for law is, that you may see a file of soldiers, colonel, captain, corporal, privates, powder-monkeys, and all, marching in admirable order over hill and dale to the wars, against their wills, ay, against their common sense and consciences, which makes it very steep marching indeed, and produces a palpitation of the heart.”
—Henry David Thoreau (1817–1862)