PDF File Finder
This script is designed to find deleted PDF files using the header, '%PDF-#.#' (GREP), and the footer, '%%EOF'.
The script was primarily designed for the recovery of PDF files generated during the CUPS (Common UNIX Printing System) spooling process. Unlike other types of PDF, these are guaranteed to have a single footer at the end.
PDFs that are not printer spool files may have more than one occurrence of the footer due to the way in which PDFs can be extended. Such files may be corrupt or partially complete when recovered.
This script was developed for use in EnCase training. For more details, please click the following link:
Download Now