Skip to content

Scan and Review with Bulk Extractor Record Carving

This procedure uses the rec03 scanner and BEViewer shown in the supplied SUSA screenshots. Work from a verified image and create a new output directory for each run.

Define the scan

Input

Record the working-image path, format, capacity and matching SHA-256.

Scanner scope

Run `-H` or review the GUI scanner list, then enable only plugins required by the question.

Output

Use a new case-linked directory on separate controlled storage and retain logs and report XML.

For an EVTX-only record carve, the equivalent command is:

bulk_extractor.exe -E evtx -o "X:\SUSA-BE-073\bulk-output" "D:\Evidence\SUSA-BE-073.raw"

For a bounded NTFS record carve using several rec03 plugins:

bulk_extractor.exe -x all -e ntfsindx -e ntfslogfile -e ntfsmft -e ntfsusn `
  -o "X:\SUSA-BE-073\bulk-output" "D:\Evidence\SUSA-BE-073.raw"

-E runs one scanner exclusively. The -x all -e ... form enables only the listed scanner set. Confirm actual names in the installed build and record the complete command or GUI configuration.

The output directory is part of the evidence trail

Do not reuse a populated report directory. Keep it separate from the input, preserve report.xml, logs and feature files, and record interrupted or failed scans rather than silently rerunning into the same path.

Use BEViewer

  1. Open the scan control from BEViewer's toolbar.
  2. Select the verified image and a new output feature directory.
  3. Enable only the intended scanner or scanners and preserve the generated command/configuration.
  4. Start the scan and record progress, start and finish times, warnings and completion state.
  5. Expand the completed report in the Reports pane.
  6. Select evtx_carved.txt, another *_carved.txt feature file, or a histogram that answers the question.
  7. Preserve the feature row's forensic path, offset, size, value and context.
  8. Use the image/context pane to review surrounding bytes safely; never execute carved content.
1 Report›2 Feature file›3 Feature row›4 Context›5 Independent parser

Judge the result

  • Forensic path first
    Retain the source offset and transformation path; a displayed value alone is not attributable.
  • Integrity state matters
    Separate validated carved records from output labelled corrupted or incomplete.
  • Parse independently
    Use an appropriate parser, such as a compatible EVTX parser, and retain its version and errors.
  • Corroborate meaning
    A carved record can support content presence in scanned bytes but may lack the original file, allocation and lifecycle context.

Record the input hash, command or GUI settings, tool versions, report directory, feature file, forensic path, selected context, validation result, confidence and limitations.

PreviousInstall and openNextPractise the workflow