File Carving vs Data Recovery: What’s the Difference?

When a file is deleted, its contents are not necessarily erased immediately. Depending on the filesystem and storage device, the operating system may mark the space occupied by the file as available for reuse while some of the original data remains on the storage medium.

This is why deleted files can sometimes be recovered during digital forensic investigations.

Two techniques commonly associated with recovering lost files are data recovery and file carving. Although the terms are related, they describe different things. Data recovery is the broader process of retrieving lost, deleted, corrupted, or inaccessible data. File carving is a specific technique that identifies and extracts candidate files from raw data without relying on filesystem metadata to locate them.

Understanding the difference helps forensic examiners choose appropriate recovery methods, interpret their results, and recognize the limitations of recovered evidence.

File Carving vs. Data Recovery: The Key Differences

Imagine a library where a book has gone missing. A librarian might search the catalogue, check shelf records, and examine misplaced pages to locate it. This resembles data recovery, which can use several sources of information to retrieve lost files.

File carving takes a different approach. Even if the catalogue and shelf labels are missing, some pages might remain. By recognizing the book's content and structure, it may be possible to identify and reconstruct the material without knowing its original location.

The same distinction applies to digital storage.

The main distinction is that data recovery describes the overall process, while file carving is one technique used to recover data. A single recovery application may use both methods during the same examination.

What Is Data Recovery?

Data recovery is the process of retrieving data that has been deleted, lost, corrupted, or made inaccessible.

When a file is deleted, the filesystem may update or remove records that identify the file and its storage locations. However, some of the original content may remain until it is overwritten or otherwise becomes unavailable.

Recovery tools examine the information that remains and attempt to reconstruct the file.

Consider a directory containing three files:

Case_Evidence/
├── photo1.jpg
├── photo2.jpg
└── report.pdf

After photo1.jpg is deleted, it may disappear from the normal directory listing. Its contents, however, might remain on the storage device.

A recovery tool may locate the deleted file through surviving filesystem records and recover some or all of its contents. If those records are no longer available, another recovery technique may be necessary.

Common data recovery approaches include:

• Filesystem-based recovery: Uses surviving filesystem records to locate deleted file content.
• File carving: Searches raw data for recognizable file formats.
• Filesystem repair or reconstruction: Attempts to restore access to data by repairing or interpreting damaged filesystem structures.
• Backup recovery: Restores files from available backups or previous versions.

These methods address different situations. The appropriate approach depends on the filesystem, the condition of the storage device, and the information that remains available.

What Is File Carving?

File carving is a data-recovery technique that identifies and extracts candidate files by examining raw data for recognizable patterns and file structures.

Unlike filesystem-based recovery, carving does not depend on filesystem records to identify where a file is located. Instead, it examines the available data for patterns associated with known file formats.

For example, a deleted JPEG photograph may remain in unallocated space even when the filesystem record containing its original filename is no longer available. A carving tool may locate the image by recognizing its binary structure and extracting the corresponding data.

The result is a candidate recovered file. It must still be checked to determine whether it is complete, valid, and relevant to the investigation.

How file carving works

A simplified file-carving workflow looks like this:

The exact process varies by tool and file format. Some formats contain recognizable headers and footers, while others require more sophisticated structural analysis to determine where a file begins and ends.

How file signatures help recover files

Many file formats contain recognizable byte sequences called file signatures or magic numbers. These patterns help carving tools identify possible files within raw data.

Examples include:

These signatures provide useful starting points, but a matching pattern does not prove that a complete file exists at that location.

For example, a carving tool may find a JPEG header but encounter missing or overwritten data later in the file. It might extract a partial image rather than a complete photograph. A matching byte pattern can also occur within unrelated data, creating a false positive.

For this reason, file carving involves more than searching for a signature. The tool must attempt to identify the candidate's boundaries, and the examiner should validate the extracted content.

PNG files, for instance, use a structured sequence of chunks, including an IEND chunk that marks the end of the image datastream. A carving tool can use such structural information to help determine file boundaries.

File Carving vs. Filesystem-Based Recovery

The two methods differ primarily in how they locate a file's content.

Filesystem-based recovery

Filesystems maintain records that help the operating system organize files and identify their locations. Depending on the filesystem, these records may include filenames, directory relationships, allocation information, and references to data blocks.

If enough relevant information survives deletion, a recovery tool may use it to locate and reconstruct the file.

A simplified representation is:

Filename
   |
   v
Directory entry
   |
   v
Filesystem metadata
   |
   v
File data locations
   |
   v
Recovered file

This approach may preserve useful contextual information, including the original filename and directory path, when the relevant metadata remains intact.

For example, on an NTFS volume, a recovery tool may examine a surviving Master File Table (MFT) record to identify a deleted file and locate its data. Recovery depends on whether the required record and file content remain available.

File carving

File carving searches raw data for recognizable file content rather than relying on filesystem records to locate it.

Raw storage data
       |
       v
Find file signature
       |
       v
Analyze file structure
       |
       v
Extract candidate data
       |
       v
Validate recovered content

Because carving does not rely on the original filesystem record, the recovered file may lack its original filename, directory path, and filesystem timestamps. Some file formats contain internal metadata, but this is not equivalent to recovering the original filesystem information.

Why this difference matters in digital forensics

Suppose an examiner is investigating a deleted photograph.

If the filesystem record survives and identifies the photograph's data locations, filesystem-based recovery may be the most direct approach. It may also preserve useful context about where the file was stored.

If that record is missing or damaged but the photograph's bytes remain, file carving may still recover the image.

Forensic examiners can therefore use both techniques during the same investigation. Filesystem-based recovery can provide contextual information, while carving may identify additional files that are no longer associated with usable filesystem records.

When Is File Carving Useful?

File carving is particularly useful when filesystem metadata is unavailable, damaged, or insufficient to locate the files being investigated.

1. Recovering deleted files

Deleted files may remain in storage areas that have been marked as available for reuse. If enough of the original content survives, carving may identify and extract it.

However, deletion alone does not guarantee recoverability. The relevant data may already have been overwritten or made unavailable.

2. Examining unallocated space

Unallocated space is storage that the filesystem considers available for new data. It may contain remnants of deleted files until their contents are overwritten or otherwise become inaccessible.

A forensic examiner can scan this space for recognizable file structures and attempt to recover candidate files.

3. Investigating damaged filesystems

If filesystem structures are corrupted, conventional recovery may be limited. Carving provides another way to search the underlying data for recognizable file content without depending on intact directory records.

4. Examining formatted storage

Formatting can replace or initialize filesystem structures, depending on the operation performed. Some previous file content may remain, allowing carving to recover candidate files.

Success depends on the type of formatting, subsequent writes, storage technology, and condition of the data. Formatting does not always leave recoverable content behind.

5. Analyzing raw forensic images

File carving can be performed on suitable forensic images, allowing examiners to search acquired data without relying on the original filesystem to locate every file.

In a forensic examination, the original evidence should be preserved and recovery should follow an appropriate, documented workflow using a verified image or working copy.

Limitations of File Carving

File carving can recover valuable evidence, but it cannot guarantee that every deleted file will be reconstructed.

Overwritten data

When new data overwrites the storage locations containing a deleted file, the original bytes may be partially or completely destroyed.

Original file
     |
     v
File deleted
     |
     v
Storage space reused
     |
     v
Original bytes overwritten
     |
     v
Recovery may be incomplete

Carving cannot recreate original data that no longer exists in the examined source unless another copy or a means of reconstruction is available.

Fragmented files

A file is not always stored in one continuous sequence of blocks. Filesystems may distribute its content across multiple locations, creating fragmentation.

If a carving tool identifies the beginning of a fragmented file, it may not know how to locate and correctly assemble all the remaining fragments. Simple carving techniques may produce incomplete or corrupted output.

Advanced methods can attempt fragment reconstruction, but success depends on the file format, the remaining data, and the technique used.

Loss of filesystem metadata

A carved file may lack its original filename, directory path, and filesystem timestamps.

This matters in digital forensics because context can be as important as content. Recovering a photograph does not, by itself, establish where it was originally stored, who created it, or when it was deleted.

Examiners should distinguish metadata recovered from the filesystem from information embedded within the file itself.

False positives and corrupted output

A matching signature does not necessarily indicate a valid, complete file. A tool may extract an incomplete file, interpret unrelated data as a candidate, or produce corrupted output.

Investigators should validate recovered content using suitable format-aware tools and document any uncertainty about completeness or origin.

SSDs and TRIM

Recovery from solid-state drives (SSDs) can be affected by TRIM and related storage-device behavior.

After deletion, the operating system may notify the SSD that certain storage blocks are no longer needed. The controller may subsequently make the previous contents unavailable or erase them during internal operations.

Consequently, deleted data may be less recoverable from an SSD than from storage where the original bytes remain intact. The outcome depends on the device, operating system, filesystem, and subsequent activity.

How to Validate Carved Files in Digital Forensics

Recovering a candidate file is only one stage of a forensic examination. The examiner must also establish what was recovered, how it was recovered, and what conclusions the evidence supports.

A practical validation workflow includes the following steps.

1. Preserve the evidence. Acquire or use an appropriate forensic image and follow the required evidence-handling procedures.
2. Document the source. Record the source image, relevant byte offset or location, tool version, and recovery settings where available.
3. Validate the file format. Use a suitable parser or application to check whether the recovered content follows the expected format.
4. Check for missing data. Determine whether the file appears truncated, fragmented, or corrupted.
5. Calculate a hash. Record a SHA-256 hash of the recovered output to support subsequent integrity checks. A matching hash can confirm that two copies are identical, but it does not prove that the file is complete or authentic.
6. Correlate with other evidence. Compare the recovered content with surviving filesystem records and other relevant forensic artifacts.
7. Document limitations. Explain what the tool recovered, what remains uncertain, and which conclusions cannot be established from the recovered file alone.

This process helps ensure that a recovered file is not automatically treated as proof of its origin, authenticity, or significance.

Common File Carving Tools

Several digital-forensics tools support file carving or related file-recovery workflows.

Tool capabilities vary by version, configuration, and file format. Examiners should understand how a tool identifies and extracts candidate files rather than relying on its output without validation.

File Carving in a Forensic Investigation: A Practical Example

Consider an examiner who receives a forensic image of a storage device during an investigation involving deleted photographs.

The examiner needs to determine whether relevant images remain recoverable and document the methods used.

A practical workflow could be:

1. Verify and document the forensic image.
2. Examine the filesystem and identify relevant deleted-file records.
3. Attempt filesystem-based recovery where sufficient metadata survives.
4. Examine appropriate unallocated areas for remaining data.
5. Use file carving to identify additional candidate photographs.
6. Validate the recovered files and check for corruption or fragmentation.
7. Record hashes and document the recovery method.
8. Correlate the findings with other evidence before drawing conclusions.

This approach combines recovery methods according to the available evidence rather than assuming that one technique will recover everything.

The examiner should also document whether a recovered image came from a surviving filesystem record or was extracted through carving. That distinction can affect how the image's original location and context are interpreted.

Frequently Asked Questions