File Carving

Recovering the truth from files, images and dumps: magic bytes, carving, metadata, and timelines. A hexdump lab you solve by eye, then real disk and memory images.