Forensic File Carver
A C# forensic file-carving implementation that scans large binary sources as streams, shares signature prefixes in a byte trie, and applies format-aware boundary checks when a defensible end position can be determined.
This project isolates a file-carving approach I use when filesystem metadata is absent, damaged, or no longer sufficient for a trustworthy recovery decision. Rather than scanning the source independently for every signature, the scanner stores shared byte prefixes in a trie. Input is consumed in overlapping blocks so a signature split across two reads is still visible, while the source itself remains stream-based instead of being materialized in memory.
A header hit is deliberately treated as a candidate, not as proof of a recovered file. Where the format exposes defensible structure, the implementation derives boundaries from that structure: RIFF lengths, ZIP end-of-central-directory data, SQLite page information, TAR records, PCAP block lengths, or ISO-BMFF boxes are examples. Formats without a reliable generic end rule can remain detected-only. That conservative distinction is more useful in forensic work than producing a plausible-looking file from an unsupported boundary guess.
For another forensic transformation stage, see Forensic Telephony WAVE Decoder. The design rationale behind the scanner is discussed separately in A Data Carving Algorithm for Digital Forensics.
