ORCIDGitHubLinkedIn
RSS Curriculum Vitae TR

File Carving

Turkish equivalent: Dosya oymaDomain: Digital Forensics

Recovery of files or file fragments from raw data by identifying structural signatures and format constraints rather than relying only on file-system metadata.

Recovery Without Directory Metadata

File carving searches raw storage for recognizable file structure when directory entries or file-system metadata are missing, damaged or deliberately removed.

Simple header/footer matching works only for formats whose boundaries can be inferred that way. Fragmentation, embedded signatures and variable-size structures require stronger format-aware validation.

Forensic Boundary

A recovered byte sequence is not automatically a valid complete file. Structural checks, hashes, source offsets and recovery provenance should be preserved.

I discuss an implementation-oriented approach in Data Carving Algorithm for Digital Forensics.

Updated:

Related concepts

Digital Forensics

Related technical publications

Publications whose title or summary directly references this concept.

IBM POWER9 AC922 for Digital Forensics and Artificial Intelligence

My IBM POWER9 AC922 has been a long-running engineering platform since 2019 for digital forensics and AI work involving AltiVec/VSX, OpenMP, CUDA, Tesla V100, dlib, MXNet, FAISS, ArcFace, Kaldi, Vosk, whisper.cpp, OCR, file carving, and current CTranslate2/faster-whisper experiments.

A Data Carving Algorithm for Digital Forensics

File carving recovers candidate files without filesystem metadata by combining signatures with structural validation; header matching alone produces weak boundaries and false positives.