What is file carving?

File carving is the ability to recover lost data from a disk by looking for specific patterns of data that mark the start and ends of files. When files are deleted on a computer, the computer simply marks it as free space. The files are still there untill they are overwritten. By looking for the start and end of files (called headers and footers) in free space, we can find the lost files. Then by copying out that data in between, the data is recovered.

Tools for file carving

A good tool for file carving is Foremost. A more detailed instruction set for its installation and usage will be added soon.