File Carving

Walkthrough summary

File Carving TryHackMe walkthrough with 14 answered prompts and lab methodology notes.

Sample prompts covered

• What file signature is used to identify JPEG files?
  Open the walkthrough page to inspect the full answer and command flow.
• What file signature is used to identify Windows Shortcut files? Answer with no spaces.
  Open the walkthrough page to inspect the full answer and command flow.
• What is the ending offset address of the PNG file in Challenge1_Manual_Carve_usb.img?
  Open the walkthrough page to inspect the full answer and command flow.
• From the disk file Challenge1_Manual_Carve_usb.img, what is the flag hidden within the recovered file?
  Open the walkthrough page to inspect the full answer and command flow.
• What is the file size of the recovered image file in KB from Challenge2_slack_space.img?
  Open the walkthrough page to inspect the full answer and command flow.