Footer

From ForensicsWiki
Jump to: navigation, search

File footer is a data structure at or very near the end of the file.

Some file formats have well-defined footers, easily identified by signatures or other methods. Other file formats do not have any identifiable footers, but just have their data end.

File footers are useful in file carving, where they are used to identify the end of file, and in validation during or after data recovery.