File Carving and Recovery Tools
For a file carving and recovery tool, the first results are sleuthkit/scalpel (Scalpel is a dedicated command-line file carving tool that recovers files from disk images by matching file signatures, which directly matches the forensic data recovery purpose but is a basic implementation lacking advanced techniques and active maintenance), devttys0/binwalk and ahupp/python-magic (python-magic is a library for identifying file types by magic bytes, not a tool for carving files from disk images—it provides a building block for signature detection but lacks carving, disk image support, and recovery capabilities). ericzimmerman/bstrings and vstinner/hachoir3 round out the shortlist. Compare the match explanations and check the project documentation against your requirements.
These open-source utilities extract and reconstruct deleted files directly from raw disk images and storage media.
File Carving and Recovery Tools
Find the best repos with AI.We'll search the best matching repositories with AI.
- sleuthkit/scalpel
sleuthkit/scalpel
Scalpel is an open source data carving tool. It is not being actively maintained.
Scalpel is a dedicated command-line file carving tool that recovers files from disk images by matching file signatures, which directly matches the forensic data recovery purpose but is a basic implementation lacking advanced techniques and active maintenance.
ShellFile Carving - devttys0/binwalk
devttys0/binwalk
14,048View on GitHubBinwalk is a firmware analysis tool and binary data carver used to identify and extract embedded files and data segments from binary images. It functions as an embedded file extractor and data entropy analyzer to retrieve fragments from binary blobs when original file system structures are missing. The tool employs signature-based pattern matching and linear byte-stream scanning to detect known byte sequences and isolate hidden files. It uses sliding-window entropy analysis to locate regions of a file that are compressed or encrypted. The system supports recursive file carving, utilizing heu
Binwalk is a firmware analysis tool that carves embedded files from binary images using signature matching, but it is specialized for firmware rather than general disk images and does not cover file-system-level deleted file recovery, so it is adjacent to the forensic data recovery tool you need.
RustCarving and ExtractionFile Carving - ahupp/python-magic
ahupp/python-magic
2,886View on GitHubpython-magic is a C-binding wrapper that provides a Python interface for the libmagic system library. It functions as a file signature analyzer and MIME type detector, identifying file formats by comparing header bytes against a database of known binary signatures. The library enables the identification of file types from both file paths and raw data buffers. It supports custom file signature matching through the injection of user-provided magic databases, allowing for the detection of specialized or proprietary formats. The project covers binary data analysis and MIME type mapping to transl
python-magic is a library for identifying file types by magic bytes, not a tool for carving files from disk images—it provides a building block for signature detection but lacks carving, disk image support, and recovery capabilities.
PythonMagic Byte File Identification - ericzimmerman/bstrings
EricZimmerman/bstrings
A better strings utility!
Bstrings is a utility for extracting and sorting strings from binary data, which supports forensic analysis but does not perform file carving or recover deleted files from disk images.
C#Carving and Extraction - vstinner/hachoir3
vstinner/hachoir3
Hachoir is a Python library to view and edit a binary stream field by field
Hachoir is a Python library for inspecting and editing binary streams field by field, which is a lower‑level building block for file carving rather than a dedicated file carving or data recovery tool for disk images.
PythonFile Carving - williballenthin/evtxtract
williballenthin/EVTXtract
EVTXtract recovers and reconstructs fragments of EVTX log files from raw binary data, including unallocated space and memory images.
This tool carves EVTX log fragments from raw data, including unallocated space, but it is specialized for a single log format rather than the general file‑carving and data‑recovery workflow from disk images you’re after.
PythonFile Carving - google/magika
google/magika
17,139View on GitHubMagika is an AI content type classifier and MIME type prediction engine that uses deep learning to identify file formats based on binary data. It analyzes byte sequences through a neural network to predict the content type of a file and provide associated confidence scores. The system features a foreign function interface that allows the core detection logic to be integrated across different programming languages. It includes a mechanism for configuring detection sensitivity and per-type thresholds to balance precision and recall. The project provides capabilities for bulk file analysis via
Magika is a deep-learning file type classifier that identifies content types, but it does not perform file carving, recover deleted files, or handle disk images — it is a supporting component rather than the forensic recovery tool you need.
PythonContent Type Detection - google/grr
google/grr
5,074View on GitHubGRR is a distributed incident response platform and asynchronous forensic task orchestrator. It functions as a remote forensics framework designed to collect and analyze volatile data, system memory, and digital artifacts from remote hosts during security incident response. The system operates as a remote endpoint triage system, utilizing a coordinated architecture to manage a fleet of agents. It enables the execution of investigative tasks across multiple systems, allowing for the search of files and registries across a large fleet of machines to identify compromised hosts. The platform pro
GRR is a remote incident response platform for live endpoint triage and artifact collection, not a dedicated file carving or data recovery tool for disk images — it lacks the core capability of carving deleted files from disk images by signatures.
PythonRaw Disk Analysis
Compare the top 10 at a glance
| Repository | Stars | Language | License | Last push |
|---|---|---|---|---|
| sleuthkit/scalpel | 684 | Shell | — | |
| devttys0/binwalk | 14K | Rust | MIT | |
| ahupp/python-magic | 2.9K | Python | other | |
| ericzimmerman/bstrings | 152 | C# | MIT | |
| vstinner/hachoir3 | 665 | Python | GPL-2.0 | |
| williballenthin/evtxtract | 212 | Python | Apache-2.0 | |
| google/magika | 17.1K | Python | Apache-2.0 | |
| google/grr | 5.1K | Python | Apache-2.0 |