Actual

File carving tool for forensic image recovery, inspired by foremost

Actual supports 8 image formats: JPEG, PNG, GIF, BMP, WebP, TIFF, ICO, and PNM

Installation

make install

Usage

# Show help
sudo actual --help

# Recover all image types
sudo actual -i disk.img

# Recover specific types only
sudo actual -i disk.img -t jpg,png

# Quick mode (sector-aligned search)
sudo actual -i /dev/sdb -q

# Verbose output with custom output directory
sudo actual -i disk.img -o recovered -v

# Skip images smaller than 100KB
sudo actual -i disk.img --min-size 100K

License

MIT License. See LICENSE file for details.