Package information

cCarve is a command line tool for carving attributed dump sets, written in C++. The dump sets can, for instance, be obtained by dumping the memory of a number of smart cards or by regularly dumping the memory of a single smart card during its lifetime. The tool helps in determining at which location in the dumps certain attributes are stored. cCarve is based on mCarve. cCarve implements a linear algorithm for carving attributed dump sets, which improves its run time with respect to mCarve.
More information about mCarve can be obtained from this paper.

Authors: Ton van Deursen, Piotr Kordy, Sjouke Mauw, and Saša Radomirović,.



To run the (dynamically linked) program it is necessary to have program_options,system and filesystem(v3) libraries from Boost

In order to build mcarve written in C++ you will need:

Compilation guidelines:

  1. Installing dependencies:
    Linux Debian
    Procedure should work on Ubuntu and similar distributions:
    • install appropriate packages:
      sudo apt-get install libboost-program-options-dev libboost-system-dev libboost-filesystem-dev libsparsehash-dev cmake make gcc g++
    • install ccmake (optional - for nicer user interface for cmake):
      sudo apt-get install cmake-curses-gui
    • download lzz from and put it (for example) in /usr/local/bin
      mv lzz /usr/local/bin
    • install Xcode
    • install MacPorts
    • install needed libraries:
    • sudo port install cmake
      sudo port install boost
      sudo port install google-sparsehash
    • download and unzip and put lzz in /usr/local/bin
  2. Compiling:
    • Download, unpack the sources package and go to the created directory:
      cd ccarve-1.0.0-Source
    • Create build directory (for out-of-source build)
      mkdir build
    • Run cmake (or ccmake) and make. This should build command line executable and tests:
      cmake ..
  3. Convering projects from mcarve:
    To convert the project from mcare progrm we can use the located in src directory of the source package.
    python oldProject.prj > newProject.prj