I recently destroyed (on accident, of course) someone’s file-system. Big time bummer. I needed to recover some files that were made with OpenOffice. The file carving route made the most sense, so I used Bless to inspect a collection of OpenOffice files I had around and made these definitions to work with Foremost and Scalpel. They worked like a charm! Here they are for your benefit:
#--------------------------------------------------------------------- # OPENOFFICE FILES #--------------------------------------------------------------------- odt y 10000000 PK????????????????????????????mimetypeapplication/vnd.oasis.opendocument.textPK META-INF/manifest.xmlPK???????????????????? ods y 10000000 PK????????????????????????????mimetypeapplication/vnd.oasis.opendocument.spreadsheetPK META-INF/manifest.xmlPK???????????????????? odp y 10000000 PK????????????????????????????mimetypeapplication/vnd.oasis.opendocument.presentationPK META-INF/manifest.xmlPK???????????????????? odg y 10000000 PK????????????????????????????mimetypeapplication/vnd.oasis.opendocument.graphicsPK META-INF/manifest.xmlPK???????????????????? odc y 10000000 PK????????????????????????????mimetypeapplication/vnd.oasis.opendocument.chartPK META-INF/manifest.xmlPK???????????????????? odf y 10000000 PK????????????????????????????mimetypeapplication/vnd.oasis.opendocument.formulaPK META-INF/manifest.xmlPK???????????????????? odi y 10000000 PK????????????????????????????mimetypeapplication/vnd.oasis.opendocument.imagePK META-INF/manifest.xmlPK???????????????????? odm y 10000000 PK????????????????????????????mimetypeapplication/vnd.oasis.opendocument.text-masterPK META-INF/manifest.xmlPK???????????????????? sxw y 10000000 PK????????????????????????????mimetypeapplication/vnd.sun.xml.writerPK META-INF/manifest.xmlPK????????????????????
Tags: .odt, file carving, Foremost, OpenDocument, OpenOffice, Scalpel