magicrescue

Magic Rescue is a file carving tool designed for forensics investigations. It scans block devices or forensic images for file types it recognizes by examining magic bytes (file patterns) in the content. As long as the file data is intact, it can recover it regardless of filesystem damage.

The tool relies on 'recipes'—configuration files containing strings and commands to identify and extract specific file types. Predefined recipes are available for formats like avi, jpeg, mp3, png, zip, and others. Users can also create custom recipes for additional file types.

The package includes three main commands: magicrescue for scanning and extraction, dupemap for duplicate elimination via checksums, and magicsort for categorizing recovered files using the file(1) utility.

Magic Rescue examines raw data on block devices for magic bytes matching patterns defined in recipe files. When a match is found, it invokes external programs specified in the recipe to extract the file. Recipes provide identification strings and extraction commands, enabling recovery of files like AVI, JPEG, MP3, PNG, ZIP, and specialized formats such as Canon CR2 or Nikon RAW without relying on filesystem metadata.