File carving is an extremely useful method in forensics because it allows for data that has been deleted or hidden to be recovered for analysis. In simple terms, file carving is the process of reassembling files from fragments in the absence of file system metadata. In file carving, specified file types are searched for and extracted across the binary data to create a forensic image of a partition or an entire disk. File carving recovers files from the unallocated space in a drive based merely on file structure and content, without any matching file system metadata.
Unallocated space refers to the part of the drive that no longer holds any file information, as pointed by file system structures such as file tables.
Files can be recovered or reconstructed by scanning the raw bytes of the disk and reassembling them. This can be done by...
