Data Recovery and File Carving: Deleted, Hidden and Encrypted Data

Deletion is a logical operation whose implementation differs across filesystems. An open file, a retained snapshot or a backup can remain accessible after a directory entry disappears. Storage reuse, discard and encryption determine whether underlying bytes can still be read.

On NTFS, examine a deleted file record’s state, attributes and retained data runs. Small resident content may be inside the record itself. Reused records, overwritten clusters and incomplete metadata can prevent reconstruction; an old filename and plausible size do not establish intact content.

For ext4, inode and allocation changes, journal mode and retained transactions affect recovery. The journal is a bounded filesystem mechanism, not a permanent archive of every deleted file. Tools must support the actual features; a journal inode is not universally a separate partition or a guaranteed old-content store.

APFS snapshots can retain referenced historical content. Copy-on-write does not promise every deleted version, and storage access or encryption can still limit examination. Identify actual retained snapshots before relying on them.

FAT directory deletion commonly uses a 0xE5 first-byte marker, while exFAT uses entry-state flags and an allocation bitmap. A FAT chain may have been cleared, and exFAT files can use contiguous allocation without a chain. Apply the correct format’s rules instead of treating the two as identical.

Protect the source and retain an acquisition log. Read-only handling and filesystem-specific no-replay options need validation; one mount command is not safe for every format. Perform any necessary repair or replay on a separately documented analysis copy.

File carving searches for content patterns and structural relationships when ordinary file references are absent or inadequate. A signature hit identifies a candidate, not necessarily an intact file. Preserve the source offset, selection settings and output relationship.

Typical clues include JPEG start/end markers, the PNG signature and terminal IEND chunk, PDF structures, ZIP records and SQLite headers. Some formats have no simple footer; internal lengths, directories, pages or checksums matter. Office Open XML files are ZIP-based packages whose members distinguish their application type.

Run the selected tool against the appropriate image or decrypted view and write outputs to separate storage. Record version, format filters, scan range and errors. Retain invalid or partial output only with a clear label and an explanation of its relevance.

Fragmentation can defeat a simple forward scan. Some tools have format-specific reconstruction capabilities, including PhotoRec options for certain fragmented JPEGs; no product reconstructs every fragmented file. Compare internal validity and content, and do not treat a file extension assigned by a carver as independent authentication.

Validate structure, expected length, embedded metadata and readability using suitable tools. Duplicate or overlapping candidates can represent the same bytes. A recovered picture or document may lack the original filename, path or reliable event time; report those gaps.

SSDs present logical addresses through a controller that manages flash translation, wear levelling and reclamation. Filesystem deallocation, delivery of a discard request, changes in readable logical data and physical erasure are distinct events.

ATA TRIM, SCSI UNMAP and other interface-specific deallocation mechanisms do not establish one universal erasure deadline. Configuration, bridges, controller behaviour, workload, encryption and power state affect the outcome. Minutes since deletion cannot establish that every former byte is physically erased.

A write blocker can prevent host writes under its validated capabilities, but it does not freeze all internal controller activity. Pulling power can also lose volatile access or encryption state. Responders should make a documented decision for the actual device rather than follow a universal plug-pulling rule.

Identify media, controller/interface, capacity, encryption and read behaviour. Capture accessible data under the approved method and record any unreadable regions or substitutions. A zero-filled read is an observation at that interface, not proof of exactly when or how flash cells were erased.

Chip-off is specialised and may be ineffective or destructive. Translation, error correction and hardware-linked encryption can prevent useful reconstruction. Do not promise that spare flash pages are recoverable or that raw-chip access supplies plaintext.

Check retained snapshots, backups, synchronised versions, attachments and recipient copies within the authorised scope. These are separate sources with their own provenance, not proof that deleted local content still exists.

A blank-looking device may contain a damaged partition map, a newly created filesystem, overwritten areas or inaccessible encrypted data. Determine which condition is supported before selecting a recovery method.

Quick formatting commonly replaces filesystem structures but can also involve discard or other format-specific changes. Full-format behaviour depends on the platform and options; Windows documents options that write across the volume. Neither the word “format” nor the elapsed time alone predicts recoverability.

For MBR and GPT, examine actual sector sizes, primary and backup structures, partition bounds and filesystem signatures. GPT table size is not universally the first 17 KiB, and an intact backup does not guarantee every partition’s content survived.

TestDisk can search for candidate partitions and inspect supported filesystem contents. On an analysis copy, record the proposed layout, offsets, overlaps and validation. A plausible signature can be stale or false; confirm geometry and contents before accepting the reconstruction.

Rewriting a partition table is a modification. Preserve the original acquisition and work on a disposable copy if a write is necessary; extraction may be possible without repair. Standard dd produces raw output, not an E01 container merely because the filename ends in .E01. Record the actual acquisition format and verification.

Hypothetical example: a copied disk image lacks a usable primary partition map but contains a coherent filesystem at a later offset. The examiner documents the candidate bounds and extracts test files without altering the preserved image. The conclusion concerns the recovered layout and validated contents, not the cause or intent of the damage.

Correctly implemented encryption changes recovery from finding familiar plaintext signatures to obtaining supported access. Identify the product, version, key protectors and available authorised credentials or recovery material.

For BitLocker, recovery material may exist in a configured organisational escrow, a Microsoft account, a printed record or another retained source. Escrow is not universal. Apple FileVault, LUKS and VeraCrypt use different protection and recovery arrangements; do not transfer one product’s key-slot count or recovery procedure to another.

If a system is already accessible, a supported logical acquisition may preserve relevant plaintext. Memory examination can sometimes help under specific conditions, but a usable master key is not guaranteed. Modern hardware protections and reduced hibernation files make a generic memory-to-key recipe unreliable.

Cold-boot research demonstrated memory-remanence attacks on particular systems. It is not a universal contemporary phone or Mac recovery procedure, and cooling or rebooting a device can change or destroy evidence. Specialist feasibility must be assessed for the actual hardware.

Password testing applies only when the format, key derivation, required metadata and candidate search are supported. Verify tool modes against the installed release rather than rely on a static table. Strong keys and random recovery material are not equivalent to weak user passwords.

Consent, compelled disclosure, organisational access and provider requests have different legal requirements that vary by jurisdiction. Obtain appropriate authority and specialist advice; a production order does not itself decrypt protected material.

A VeraCrypt hidden volume is designed to resemble random outer-volume free space. High entropy or a program’s presence does not prove it exists. Report independently supported artefacts and any successfully accessed volume without claiming a reliable entropy test for hidden-volume detection.

Hidden data can occur in named streams, slack, unallocated space, unused partition gaps, additional partitions, archives or application-specific stores. These are different structures and need separate identification and extraction.

Calculate slack from the actual allocation unit and file layout. A 12 KiB nonresident file in one 16 KiB allocation unit leaves up to 4 KiB of end-of-unit slack under that assumption; compressed, sparse and resident data need different treatment. A fragment does not identify the previous owner of that space.

Partition gaps are layout-dependent; sectors 1–62 are not a universal unused region, particularly on GPT. EFI partitions contain legitimate boot material. Examine provenance, signatures, configuration and corroborating activity instead of calling every unfamiliar boot file a bootkit.

On applicable ATA devices, HPA or DCO can affect exposed capacity. Detection and access commands have device-specific capabilities and risks; do not change capacity settings on original evidence as a routine discovery step.

Steganography embeds data in a carrier, while encryption obscures its meaning. As a simple capacity illustration, a 1920 × 1080 uncompressed RGB image has 2,073,600 pixels and 6,220,800 colour samples. One payload bit per sample gives 777,600 bytes before overhead. This is not the capacity of an arbitrary JPEG, whose compression needs a different embedding model.

Statistical detectors can produce false positives and negatives. Compare suitable baselines and try supported, tool-specific extraction where justified. A failed extraction does not prove no payload exists, and an anomalous distribution does not establish the password, author or intent.

Record carrier hashes, extraction method, any credential source and recovered-output hashes. Connect findings to independent activity records while keeping technical access, authorship and legal conclusions separate.