drop a raw disk image or binary · carve ole2 compound documents from raw bytes using directory structure signatures · recover word excel powerpoint old format files · more reliable than header-only carving · reconstruct compound documents from fragments · runs locally
disk / binary
drop image or blob
or click
magic D0 CF 11 E0 · directory stream names · CLSID type ID
drop raw disk image or binary · OLE2 compound document carve