What is ‘file carving’


Virtual Assistant, Web Design and bookkeeping services

File carving is a technique used for retrieving deleted files or data from a hard drive or memory dump.
When data is hard deleted its metadata was deleted, so there is no longer a reference to its location in
the memory. By knowing the magic number, the file’s characteristic signature written in the header of the
file, file carving software will be able to recognise and identify similar files from its database of magic
File carving is of no use when the header with the file signature has been overwritten by new data. In this
case, the file carving software won’t be able to find the magic number as it is no longer there. The
technique won’t work either when the files are heavily fragmented like on solid-state drives. It will fail to
put all the fragments together as they are not allocated to contiguous clusters on the drive.

You May Also Like…

The origins of Java

The origins of Java

In 1990, Patrick Naughton, a disgruntled software engineer working for Sun Microsystems (the company was acquired and...

What is procedural programming?

What is procedural programming?

Before object-orientation the predominant method for structuring programs was procedural programming. Procedural...


Submit a Comment

Your email address will not be published. Required fields are marked *