WHAT IS FILE CARVING??
File Carving is the process of reassembling computer files from
fragments in the absence of file system metadata.
It is the process of extracting a collection of data from a larger data set.
Data carving techniques frequently occur during a digital investigation
under ComputerForensics when the unallocated file system space is
analysed to extract files.
The files are “carved” from the unallocated space using file type-specific
header and footer values.
ComputerForensics is a branch of digital forensic science
pertaining to legal evidence found in computers and digital storage
The goal of computerforensics is to examine digital media in a
forensically sound mannerwith the aimof identifying, preserving,
recovering, analysing and presenting facts and opinions about the
HOW THE DATA IS HIDDEN??
Deleting A File
Sends the file to Windows Recycle Bin
Undeleted tools depend on the deleted directory entry
• That can be deleted or overwritten too
• Then there is no undeleting possible
Store Files in a TrueCrypt/VeraCrypt/CipherShed Volume
Undetected as a file(except for My tools)
Looks like random data in unallocated space
FILE RECOVERY VS. FILE CARVING
• File recovery techniques make
use of the file system information
that remains after deletion of a
• For this technique to work, the
file system information needs to
be correct. If not, the files can’t
• Carving deals with the raw data
on the media.
• Carving doesn’t care about
which file system is used to store
HOW FILE CARVING WORKS??
File carving is a powerful technique for recovering files and fragments
of files when directory entries are corrupt or missing.
Every file type has its specific header and footer values. In File
Carving, raw data is searched block by block for residual data
matching the file type-specific header and footer values.
As long as data is not overwritten or wiped, deleted data on all
storage devices can be restored using carving techniques, including
multifunctional devices and even mobile phones.
FILE CARVING ASSUMPTIONS
The files searched for are not fragmented.
The beginning of the file is still present.
The signature being searched for is not a common string, which could
cause numerous false positives.
The blocks of data searched one at a time are mostly 512 bytes in
WHAT IF FRAGMENTATION OCCURS??
As files are edited, modified and deleted, most hard drives get
Also depends on allocation methodology of file system.
Fragmentation in forensically important files like email, WORD
document etc. is high. Why??
Because of constant editing, deletion and addition PST files are most
BASIC CARVING SCHEMES
• BiFragment Gap Recovery
• Given by Simson L. Garfinkel, a noted authority in computer forensics field.
• He proposed that a high percentage of files were saved in two separate
fragments, i.e., bifragment.
• Introduced by A. Pal, N. Memon. T. Sencar and K. Shanmugasundaram.
• It is used to carve out files which is divided into many fragments.
BIFRAGMENT GAP RECOVERY(CONTD.)
Simson L. Garfinkel estimated that upto 58% of outlook, 17% of jpegs
and 16% of MS-Word files are fragmented and, therefore, appear
corrupted or missing to a user using traditional data carving.
A. Pal, N. Memon. T. Sencar and K. Shanmugasundaram have
introduced a technique called SmartCarving that can recover
Can work on fragmented and non fragmented data.
Wide variety of file types supported.
Data clusters are decrypted or decompressed.
Classification of cluster to various file types.
Reassemble the blocks in sequences that match their file type.
Compressed and encrypted drive are decrypted/decompressed in this
Removing known clusters from the disk based on file system meta-
Helps increase the speed and reduce the amount of data for next phases.
Allocated files and Operating system specific data can be pruned
since it doesn’t have any use in forensics.
Classifies the disk clusters as belonging to certain file types.
Reduces the cluster pool in recovery of file of each type.
Looking for sequences to determine the type of cluster.
E.g. <html> tags in a cluster collates to html file.
ASCII characters frequency
High frequency of these indicate that data is non Video or Image.
Reassembly can be done by
Finding the starting fragment of a file that contains the header.
Merging clusters belonging to same fragment.
Finding the fragmentation point i.e. the last cluster in current segment.
Starting point of next fragment.
Ending point of last fragment. Last cluster containing the footer.
FILE CARVING TOOLS
Foremost - Originally designed by the US Air Force, it is a carver
designed for recovering files based on their headers, footers, and
internal data structures.
Scalpel - Scalpel is a rewrite of Foremost focused on performance
and a decrease of memory usage. It uses a database of header and
footer definitions and extracts matching files from a set of image files
or raw device files.
FILE CARVING TOOLS(CONTD.)
Photorec - Photorec is a
data recovery software tool
designed to recover lost files
from digital camera storage,
hard disks, and CD-ROMs
using a FTK(Forensic ToolKit)
It recovers most common photo
formats, audio files, document
formats, such as Microsoft
Office, PDF, HTML, and
• Open Source, in the early specification stages
• File Harvester
• Combination of multiple methods: Block Based Carving, Statistical Carving,
Header/Footer Carving, Header/Embedded Length Carving, File Structure
Based Carving, Fragment Recovery Carving, Repackaging Carving (Phase 3),
SmartCarving, Fuzzy Hash Carving
File Carving has revolutionized the computer forensics field by enabling
law enforcement to dig out various digital evidence which were earlier
inaccessible with the help of earlier means.
New technologies & techniques in File Carving are making it easier to
recover data with more accuracy and efficiency.
File Carving is still a developing area of computer forensics and has
made further inroads in the recovery of ephemeral data from mobile
phones as evidence.