ReviveIt

ReviveIt is a handy file recovery tool, also known as a carver. It shows off a cool proof of concept called the Smart Carving method that was first introduced back during the 2006 DFRWS forensic challenge. This method really got better in 2007 when it was refined for the next challenge.

How to Compile ReviveIt

If you're looking to compile this package, it's pretty simple! Just follow these steps:

1. 
   

   First, cd into the directory where you have the package's source code. Then, type ./configure. This sets everything up for your system. If you're using csh on an older version of System V, you might need to type sh ./configure. This stops csh from trying to run configure.

   
   


2. 
   

   This step may take some time. While it runs, you’ll see some messages popping up that tell you what features it’s checking.

   
   


3. 
   

   The next step is to compile the package by typing make.

   
   


4. 
   

   If you want to run any self-tests that come with the package, just type make check. This step is optional but can be helpful!

   
   


5. 
   

   The last main step is installing everything! Just type in make install. This will set up all programs along with data files and documentation.

   
   


6. 
   

   If you want to clean things up later, use make clean. It gets rid of program binaries and object files from your source code directory. If you need to remove files created by configure as well (to prepare for compiling on another computer), go with make distclean. There’s also a more advanced option called make maintainer-clean, but that’s mainly for developers.

   
   

Your Guide to Using ReviveIt

The usage command looks like this:

revit [-ABeFhqvV] [-b block_size] [-c configuration_file] [-t target_directory] data_file

The options available are:

• -A: create an analysis log (analysis.log)


• -b: set the block size (default is 512)


• -B: generate a buffer characteristics log (buffer.log)


• -c: choose a configuration file (default is ./file_types.conf)


• -e: revive embedded files too!


• -F: look for fragments as well.


• -h: show this usage info.


• -q: keep quiet; no status updates!


• -t: specify where your revived files should go (default folder is 'revived')


• -v: get verbose output sent to stderr.


• -V: shows the version number.