Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

Is it possible to perform data carving the data (contents) of a .RAR archive, in its compressed form? I cannot uncompress/extract the .rar file because I could not completely download it. I downloaded about 2.9 of 3.5 GBs. For data carving, I know of apps like foremost scalpel and photorec.

share|improve this question
add comment

1 Answer

That depends on the files that were stored inside the archive and its compression method. If the data was merely stored and not compressed, roughly the same data would be recoverable as if you had downloaded 2.9 GB of the 3.5 GB extracted file(s). The simplest way I know of is to open the file in a plain text editor and look for the filename you want to extract. The filename and contents are seperated by two bytes (hex: 00 c0).*

If the archive is compressed however, it's nearly impossible to extract any meaningful data. Generally, even tiny parts of the original file can only be accurately reconstructed using far bigger chunks of the archive. There's a reason these file formats use integrity checks.

*Established emperically. You may want to take a look at RAR's technote for a more thorough and general explanation of the file format.

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.