File Header Signature Search

WinHex & X-Ways

File Header Signature Search

 

Part of volume snapshot refinement.

 

The "File header signature search" operation helps to include files in the volume snapshot that can still be found in free or used drive space based on their file header signature and are no longer referenced by file system data structures. You are asked to select certain file types for detection, specify a default file size, an optional filename prefix etc. Please see File Recovery by Type and the file type definition for details. Files found with this method will be included in the volume snapshot only if there is no other file in the volume snapshot with the same start sector number yet (overwritten files don't count), to avoid duplicates. However, files that are not aligned at sector boundaries will always be included for performance reasons. Files found with this method are listed with a generic filename and size as detected by the File Recovery by Type mechanism. If applied to a physical, partitioned evidence object, only unpartitioned space and partition gaps will be searched for file headers, because the partitions are treated as separate, additional evidence objects.

 

Usually results of the file header signature search are output in a special virtual directory for carved files, which is a subdirectory of "Path unknown". However, there is an option to show resulting files as child objects of existing files, if the carved files were found within these other files.