Super User is a question and answer site for computer enthusiasts and power users. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Is it possible to perform data carving the data (contents) of a .RAR archive, in its compressed form? I cannot uncompress/extract the .rar file because I could not completely download it. I downloaded about 2.9 of 3.5 GBs. For data carving, I know of apps like foremost scalpel and photorec.

share|improve this question

That depends on the files that were stored inside the archive and its compression method. If the data was merely stored and not compressed, roughly the same data would be recoverable as if you had downloaded 2.9 GB of the 3.5 GB extracted file(s). The simplest way I know of is to open the file in a plain text editor and look for the filename you want to extract. The filename and contents are seperated by two bytes (hex: 00 c0).*

If the archive is compressed however, it's nearly impossible to extract any meaningful data. Generally, even tiny parts of the original file can only be accurately reconstructed using far bigger chunks of the archive. There's a reason these file formats use integrity checks.

*Established emperically. You may want to take a look at RAR's technote for a more thorough and general explanation of the file format.

share|improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .