File Carving
File Carving
Wiederherstellung von Dateien anhand ihrer Struktur
File carving is a forensic technique with which files can be reconstructed from raw data — even when the file system no longer contains references. Instead of relying on directory entries, the method searches for characteristic signatures and structures that mark the beginning and end of a file. This makes deleted or orphaned data visible.
History & facts. When a file is deleted, usually only the reference in the file system disappears, while the content initially remains on the data carrier. File carving searches the raw holdings for known file signatures („magic bytes“) and typical structures and reassembles files from them — independently of file names or directories. This is particularly productive on magnetic hard disks; on SSDs, TRIM can quickly destroy the remnants.
Outlook & recommendation. File carving is powerful but no sure thing: fragmented or partially overwritten files can be reconstructed only incompletely, and the method also produces false hits. It complements file-system-based analysis but does not replace it. In practice it is a valuable tool for making deleted evidence — such as exfiltrated documents or malware remnants — accessible again.