sleuthkit / scalpel

Scalpel is an open source data carving tool. It is not being actively maintained.
620 stars 101 forks source link

How to reset search to not get recurring results? #38

Open tansy opened 4 years ago

tansy commented 4 years ago

I have a raw image, not even any file system image, with lot of archived files in it. Bz2 files to be more precise and when carved header is found correctly but resulting files are containing all subsequent files as well.

+-------------------+------+----------------------+------+------------------+---
| BZh... Aaaaaa     | blaa | BZh... Bbbbbbb       | blab | BZh... Ccccc     | ...
+-------------------+------+----------------------+------+------------------+---

// and next file will be 

+----------------------+------+-------------------+---
| BZh... Bbbbbbb       | blab | BZh... Ccccc      | ...
+----------------------+------+-------------------+---

+-------------------+---
| BZh... Ccccc      | ...
+-------------------+---

and so on.

How can I reset search when next header of the same type especially is found so I get something like this:

+-------------------+------+
| BZh... Aaaaaa     | blaa |
+-------------------+------+

+----------------------+------+
| BZh... Bbbbbbb       | blab |
+----------------------+------+

+-------------------+---
| BZh... Ccccc      | ...
+-------------------+---

Is there an option for that or it would had to be developed?