File Carving
Definition
Recovery technique that scans raw disk blocks for known file headers and footers, ignoring filesystem metadata. The only option when the filesystem is corrupted, formatted or deliberately wiped.
- Method
- Scans raw disk blocks for file headers and footers
- Ignores
- Filesystem metadata
- Use case
- Corrupted, formatted, or wiped filesystems
Common questions
Why can file carving recover data when a normal file-recovery tool cannot?+
Standard recovery relies on filesystem metadata like the file table to locate files, but carving searches the raw bytes for recognisable header and footer signatures, so it still works even after that metadata is destroyed or overwritten.
What is a limitation of file carving compared to metadata-based recovery?+
Carved files usually lose their original filename, timestamps, and folder path, and fragmented files stored in non-contiguous blocks can be recovered incompletely since carving has no map of where the pieces sit.
Related terms
- BitLocker
- Microsoft's full-volume encryption on Windows. Volume Master Key wrapped under TPM, password, recovery key (48 digits), or AD/MBAM/Intune escrow. Hashcat mode -m...
- Deletion vs Erasure
- Deletion marks the file entry as free; content blocks remain until overwritten. Erasure (shred, sdelete, secure-erase) overwrites the blocks before unlinking. The...
- Steganography
- Concealing one file inside another in a way that hides the existence of the hidden file. LSB image manipulation, JPEG DCT coefficient...
- TRIM
- A command issued by the file system to the flash controller identifying blocks that are no longer in use, so the controller...
- VeraCrypt Hidden Volume
- A second, encrypted volume nested inside the free space of a primary VeraCrypt volume. Either password unlocks one of the two volumes;...