File Carving

File Carving: Recovering files from raw data using their signatures, without file system metadata. The technique is core tooling in digital forensicsDigital ForensicsPreserves and analyzes digital traces to reconstruct security-relevant events..

How it works and where it fits

Carving ignores file system bookkeeping and instead scans the data stream for characteristic header and footer markers: PK\x03\x04 for ZIP, %PDF for PDF, \x89PNG terminated by IEND. Everything between the start and end signature is extracted as a file. This works equally on deleted regions, unpartitioned storage, memory images, and network captures. The classic find is a complete file appended behind another file’s regular end.

Practical security relevance

Fragmentation sets the limits: if a file is not contiguous, simple carving yields only fragments. Compressed or encrypted containers likewise hinder signature detection. In the investigative workflow, carving follows the acquisition of a forensic imageForensic ImageA bit-for-bit copy of a storage medium for forensic analysis. and complements, but does not replace, analysis of file system metadata, which supplies timestamps and access history.

Related concepts

• Digital ForensicsDigital ForensicsPreserves and analyzes digital traces to reconstruct security-relevant events.: Preserves and analyzes digital traces to reconstruct security-relevant events.
• Forensic ImageForensic ImageA bit-for-bit copy of a storage medium for forensic analysis.: A bit-for-bit copy of a storage medium for forensic analysis.
• Evidence PreservationEvidence PreservationThe controlled acquisition and preservation of evidence without compromising its integrity.: The controlled acquisition and preservation of evidence without compromising its integrity.
• SteganographySteganographyHiding information inside innocuous carrier data so that its very existence is concealed.: Hiding information inside innocuous carrier data so that its very existence is concealed.