Find a carved region#

The middle of the Carving tab is a set of filter chips over the region list from the three carving passes. It tells you in plain text what the heatmap above shows.

The filter chips#

Chips across the top switch which regions the list shows. Each chip carries a count.

• Suspicious: a curated combination of the most actionable findings, chosen to be useful for triage.
• Polyglot: matches from the polyglot detector. Each row names the conflicting formats and the offset.
• Carved: every embedded file segment, with its detected format, offset, and length.
• Entropy regions: every entropy region the pass produced, with its bucket and byte range.

A second filter row under the chips narrows the list by entropy: All, Outliers, Packed, High, Normal, and Low. A Find offset (hex or dec)… field jumps the list to a specific offset.

Read a region row#

Each row is a single line with a click target.

• Embedded executable detected opens that embedded segment in the breakdown view.
• A packed or high-entropy region row opens that region in the breakdown view, showing its bucket, byte range, and entropy.
• A summary row that reports an aggregate, such as a count of high-entropy regions, does not link.

Click a linkable row. The Breakdown at the bottom of the tab scrolls to that range and highlights it briefly.

What 'detected' and 'suggest' mean#

The wording is deliberate. A row that says 'detected' is a positive signature match. A row that says 'suggest' is heuristic. It comes from byte statistics, not from a direct match. Use the entropy filter row when you want only one bucket.