File Carving
Definition
Recovery technique that scans raw disk blocks for known file headers and footers, ignoring filesystem metadata. The only option when the filesystem is corrupted, formatted or deliberately wiped.
Related terms
- BitLocker
- Microsoft's full-volume encryption on Windows. Volume Master Key wrapped under TPM, password, recovery key (48 digits), or AD/MBAM/Intune escrow. Hashcat mode -m...
- Deletion vs Erasure
- Deletion marks the file entry as free; content blocks remain until overwritten. Erasure (shred, sdelete, secure-erase) overwrites the blocks before unlinking. The...
- Steganography
- Concealing one file inside another in a way that hides the existence of the hidden file. LSB image manipulation, JPEG DCT coefficient...
- TRIM
- A command issued by the file system to the flash controller identifying blocks that are no longer in use, so the controller...
- VeraCrypt Hidden Volume
- A second, encrypted volume nested inside the free space of a primary VeraCrypt volume. Either password unlocks one of the two volumes;...
Explained in
- Data Recovery and File Carving: Deleted, Hidden, EncryptedRecovery technique that scans raw disk blocks for known file headers and footers, ignoring filesystem metadata. The only option when the filesystem is corrupte...