sleuthkit-users

[sleuthkit-users] File Headers/Footers in Foremost

[Brian S. <Br...@Pe...>]

Hi everyone,
 
Does anyone have a more comprehensive list of file headers/footers for the
foremost.conf file?  In particular, I am looking for and need to locate a
Microsoft Money file (.mny).  
 
If not, is there a way to obtain it by looking at the file header/footer
myself?  How can I view a file header/footer?  Thanks so much in advance!  

Brian

 

Re: [sleuthkit-users] File Headers/Footers in Foremost

[Barry J. G. <bg...@im...>]

On Thu, 2005-04-07 at 09:43 -0700, Brian Starr wrote:
> How can I view a file header/footer?  Thanks so much in advance!  

Use a hex editor.  On the command line you can use:

xxd filename | head

xxd filename | tail

look at several files of the same type to see the header/footer pattern.
 
-- 
/***************************************
Special Agent Barry J. Grundy
NASA Office of Inspector General
Computer Crimes Division 
Goddard Space Flight Center
Code 190
Greenbelt Rd.
Greenbelt, MD 20771
(301)286-3358
**************************************/