Pull the files out of a file CARVE
File carving is recovering a file from its bytes alone, with nothing to say where it starts or ends. This finds the signatures in a blob and, by reading each format to its real end, carves the files out whole.
The blob
Drop a memory dump, disk-image fragment or any file to scan for the files inside it, or
Drop a blob. It is scanned in the tab; nothing is uploaded.
How it works
Why the end is the hard part
Any tool can find where a JPEG starts: the bytes FF D8 FF are unmistakable. The skill is knowing where it ends, because the wrong end gives you a truncated image or one with a megabyte of unrelated data stuck on. A JPEG can even contain a second, smaller JPEG as its EXIF thumbnail, and a naïve carver stops at the thumbnail's end marker. CARVE walks each format's own structure (JPEG markers, PNG chunks, the PDF's %%EOF, the zip's central directory) to the byte the file actually ends on.
Doing this often? The Sovereign Console loads disk images and other evidence into one case, pulls every indicator and timestamp, and exports a report. On its own, US$4 a month; with everything else, US$9 a month or US$79 a year. 7 days free.