carlpulley/volatility — Issue #6: Implement a mimetype file reconstruction database
Author: carlpulley
Created: 2011-10-15 22:13:23+00:00
State: open

When exportfile reconstructs files, it often already has the files header.

Some files (e.g. MFT?; jpg files; etc.) can not be reconstructed by simply filling in with a default character - they need to be filled in with collections of default template patterns (to ensure expected internal file data structures are coherent).

The idea is to access the files mimetype to lookup an appropriate default template to use during file reconstruction. In this way we can have intelligent file reconstruction whilst supporting a fallback to a default character fill or similar.