# Forensic File Carver

> A C# forensic file-carving implementation that scans large binary sources as streams, shares signature prefixes in a byte trie, and applies format-aware boundary checks when a defensible end position can be determined.

- Author: Muhammet Ali Köker
- Language: en
- Canonical: https://alikoker.com.tr/en/forensic-file-carver-csharp
- Translation: https://alikoker.com.tr/forensic-file-carver-csharp
- Published: 2021-04-15T12:00:00+03:00
- Modified: 2026-08-27T10:36:29+03:00
- Verified: 2026-08-27T10:36:29+03:00
- Type: project

This project isolates a file-carving approach I use when filesystem metadata is absent, damaged, or no longer sufficient for a trustworthy recovery decision. Rather than scanning the source independently for every signature, the scanner stores shared byte prefixes in a trie. Input is consumed in overlapping blocks so a signature split across two reads is still visible, while the source itself remains stream-based instead of being materialized in memory.

A header hit is deliberately treated as a candidate, not as proof of a recovered file. Where the format exposes defensible structure, the implementation derives boundaries from that structure: RIFF lengths, ZIP end-of-central-directory data, SQLite page information, TAR records, PCAP block lengths, or ISO-BMFF boxes are examples. Formats without a reliable generic end rule can remain `detected-only`. That conservative distinction is more useful in forensic work than producing a plausible-looking file from an unsupported boundary guess.

For another forensic transformation stage, see [Forensic Telephony WAVE Decoder](/en/forensic-telephony-wave-decoder-java). The design rationale behind the scanner is discussed separately in [A Data Carving Algorithm for Digital Forensics](/en/data-carving-algorithm-for-digital-forensics).

**Source:** [GitHub](https://github.com/alikoker/forensic-file-carver-csharp)  
**Zenodo record:** [Zenodo](https://zenodo.org/records/22117441)  
**DOI:** [DOI](https://doi.org/10.5281/zenodo.22117441)

## Cite This Work

Köker, M. A. (2021). Forensic File Carver. alikoker.com.tr. https://alikoker.com.tr/en/forensic-file-carver-csharp

- BibTeX: https://alikoker.com.tr/en/forensic-file-carver-csharp.bib
- RIS: https://alikoker.com.tr/en/forensic-file-carver-csharp.ris
- CSL-JSON: https://alikoker.com.tr/en/forensic-file-carver-csharp.csl.json