Reclaimer
Recovers deleted files from raw disk images by carving for file signatures. A forensics project written in Rust.
Deleting a file usually doesn’t erase it. The system marks the space as free and rarely overwrites it straight away. Reclaimer uses that fact to find and recover deleted files from raw disk images.
How it works
Reclaimer scans an image sector by sector, looking for the fixed byte sequences that identify a file type. This technique is called file carving. When it finds one, it reads forward until the file’s end marker or a size limit, then writes out what it recovered. It doesn’t rely on the file system’s records, so it can find files those records have forgotten.
What it does today
- Opens
.img,.ddand.rawdisk images - Recovers JPEG, PNG, MP4 and PDF files
- Shows live progress, and each result’s size, sector and offset
- Runs in a native desktop interface, written in pure Rust
Current status
Reclaimer is an experimental project and still in progress. It is a good way to see how carving works, but it isn’t a validated forensic tool, so don’t rely on it for evidence or as your only hope of recovering important data. Planned work includes reading deleted file details from NTFS and scanning physical drives.