Page tree
Skip to end of metadata
Go to start of metadata

You are viewing an old version of this page. View the current version.

Compare with Current View Page History

« Previous Version 8 Next »

Introduction

This version of Blade adds Intelli-Carve® support for the recovery of Zip Archive based files and OLE2 compound based files. It includes a stand-alone version of our DataDumper tool for extracting data sub-sets and an updated Jump List deconstructor.

For a list of the changes made in this version, please see Change Log v1.12,

 

OLE2 Compound Document Recovery

Microsoft Compound File Binary (CFB) file format is also known as the Object Linking and Embedding (OLE) or Component Object Model (COM) structured storage compound file implementation binary file format.  CFB implements a simplified file system through a hierarchical collection of storage objects and stream objects.

A storage object is comparable to a file system directory in that just as a directory can contain other directories and files, a storage object can contain other storage objects and stream objects. A parent storage object can also track the locations and sizes of the child storage object and stream objects nested beneath it. A stream object is comparable to a file in that a stream contains user-defined data stored as a consecutive sequence of bytes. A compound file consists of the root storage object with optional child storage objects and stream objects in a nested hierarchy.

The file format has been used for a number of differrent file formats such as:

  • Microsoft Word up to 2003
  • Microsoft Powerpoint up to 2003
  • Microsoft Excel up to 2003
  • Windows Thumbnail files
  • Windows Installer files
  • Windows Sticky Notes files
  • Windows Jump Lists
  • Internet Explorer Tab Session and Recovery Store files

Blade® now has the ability to validate Compound Files in memory, as well as identify the file type from the stream data.

ZIP Archive Recovery

  • No labels