Home Software RecuperaBit: A Tool for Forensic File System Reconstruction

RecuperaBit: A Tool for Forensic File System Reconstruction


RecuperaBit is a piece of  software which attempts to reconstruct file system structures and recover files. Currently it supports only NTFS.

RecuperaBit attempts reconstruction of the directory structure regardless of:

  • missing partition table
  • unknown partition boundaries
  • partially-overwritten metadata
  • quick format

You can get more information about the reconstruction algorithms and the architecture used in RecuperaBit by reading this MSc thesis or checking out the slides.

Load More Related Articles
  • Invoke-LiveResponse

    Invoke-LiveResponse is a module for Live Response and Forensic collections over WinRM writ…
  • Incident Response Script for APT Hunting

    Sergey Golovanov and Igor Soumenkov have prepared a New Year present for DFIR community: t…
  • Pagefile forensics: page_brute

    page_brute.py is a digital forensic tool purposed to analyze and categorize individual pag…
Load More In Software

Leave a Reply

Your email address will not be published. Required fields are marked *