Share:
Glossary Forensics

File carving

File carving is recovering files from raw storage by searching for their start and end signatures, without relying on the file system's directory records.

Last reviewed:

AdSense Placeholder
Slot: header_reference_page

In more detail

When a file is deleted, its data often stays on disk until overwritten even though the file system no longer lists it. Carving tools scan for Magic bytes such as FF D8 FF (JPEG) and read onward to the end marker. Fragmented files are harder to carve, and recovered files have lost their names and timestamps.

Try these tools

Binary & Archive Forensics

Inspect any file's true type by magic bytes, carve embedded files at any offset.

See also

  • Glossary Magic bytes
    Magic bytes, or a file signature, are the fixed bytes at the start of a file that identify its true format regardless of its name or.
  • Glossary Forensic image
    A forensic image is an exact, bit-for-bit copy of a storage device or file system that investigators analyse instead of the original.
  • Guide How File Signatures (Magic Bytes) Work
    How the first bytes of a file identify its real type, a table of common signatures verified against real files.
Back to Glossary
AdSense Placeholder
Slot: footer_leaderboard