Carving settings
Belkasoft X allows the user to specify custom signatures to carve. You can Import, Add, Edit and Delete signatures from this window:
- Import. Using this button, you can import FTK or Scalpel signature sets. Specify the path to an FTK or Scalpel signature file and select FTK or Scalpel.
- Add. You can add your own signatures individually by clicking on Add button. The following screen will be shown:
Name is the name for your new signature; Header is hexadecimal bytes for the beginning of data, Footer is hexadecimal bytes for the end of data (optional), File extension is a hint for the Belkasoft X of what extension to save a carved file under; Artifact type is a hint for Belkasoft X of where to show carved result (on the screenshot above it is instructed to show carved data under Pictures node).
- Edit. This button opens the same window in which you edit existing signature.
- Delete. Deletes selected signatures.
Be careful, when adding custom carving signatures and make sure they are unique. Adding signatures like "00 01" will result in a huge amount of carving results and slow down the entire analysis significantly. An example of a suitably unique signature is "SQLite Format 3".