File Carving

Definitions

1. A forensic technique for recovering files or file fragments from raw storage by recognizing known headers, footers, and structural patterns even when filesystem metadata is missing. File carving is useful when files were deleted, damaged, or extracted from unmounted disk images.

   In plain English: Recovering files from raw storage data even when normal file records are gone.

   Example: "The investigators used file carving to recover JPEGs and PDFs from unallocated disk space."

Related Terms

• Anti-Forensics
• Audit Trail
• Chain of Custody
• Computer Forensics
• Digital Forensics
• Encryption at Rest
• Data Recovery
• Disk Forensics