BlockHashLoc

The purpose of BlockHashLoc (BHL) is to enable the recovery of files after total loss of File System structure, or without even knowing what FS was used in the first place.

The way it can recover a given file is by keeping a (small) parallel BHL file with a list of crypto-hashes of all the blocks (of selectable size) that compose it. So it's then possible to read blocks from a disk image/volume, calculate their hashes, compare them with the saved ones and rebuild the original file.

With adequately sized blocks (512 bytes, 4KB, etc. depending on the media and File System), this let one recover a file regardless of the FS used, or the FS integrity, or the fragmentation level.

Identification
A BHL files start with bytes, or ""+EOF in ASCII.

Format description

 * BlockHashLoc GitHub repository

Links

 * ForensicsWiki entry