To carve out in NTFS internal records and Unix utmp records, Bulk Extractor with Record Carving has been released.
