File carving: recovering data when the filesystem is gone

Delete a file and, on most filesystems, nothing is erased. The entry in the directory is marked unused and the blocks are returned to the free pool. The data sits there until something else claims the space.

Recovery comes in two flavours, and the distinction matters.

Metadata recovery versus carving

Metadata recovery uses what the filesystem still knows. On NTFS the Master File Table may still hold the record; on ext4 the journal may contain enough to reconstruct an inode. When it works it is excellent, because the filesystem knows the filename, the timestamps and, crucially, which blocks belonged together even if they were scattered.

Carving assumes none of that survives. It treats the disk as an undifferentiated sequence of bytes and looks for the shapes of files inside it. You reach for it when the partition table is gone, the filesystem is reformatted, or you are working from a raw image of damaged media.

How carving works

The basic technique is header-footer matching. Scan for a known signature, and when you find one, scan forward for the corresponding terminator.

• JPEG starts FF D8 FF and ends FF D9
• PNG starts with its eight-byte signature and ends with an IEND chunk
• PDF starts %PDF and ends %%EOF
• ZIP starts PK\x03\x04 and ends with the end-of-central-directory record

Signatures are the same ones described in magic bytes, and why a file extension is not a file type, which is not a coincidence: carving is entirely built on them.

Where a format has no footer, the carver falls back to a declared length in the header, or to a maximum size, and accepts that the tail of the recovered file may contain unrelated data.

PhotoRec is the best-known open-source implementation, recognising several hundred file families across roughly 480 extensions. Scalpel and Foremost take a configuration-file approach and are often faster over large images because they can skip block ranges. Commercial forensic suites add filesystem awareness on top.

Fragmentation is the whole problem

Carving assumes a file occupies one contiguous run of blocks. Frequently it does not. A filesystem that has been in use for a while writes files into whatever gaps exist, and a large file may be split across several.

For a fragmented file, header-footer carving produces something that starts correctly and then becomes wrong: an image that decodes for the first third and turns to noise, or an archive whose first entry extracts and whose second does not. The carver cannot tell, because it has no map.

This is why fragmentation rates matter in forensic work, why filesystem-aware carving is worth paying for, and why recovering a large video from a busy disk is dramatically harder than recovering a small photo from a freshly formatted card.

What carving cannot do

Carving needs the signature. That is the entire dependency.

A file whose header has been overwritten is not merely hard to carve, it is invisible: the scan never identifies a candidate, so there is nothing to recover and nothing to report. The same is true of a file whose structural landmarks have been destroyed throughout rather than at one point, because even a manually located candidate yields nothing a parser will accept.

That is the precise reason structural damage is so much more final than payload damage, and it is worth demonstrating rather than describing. Take a photo, produce a deliberately damaged sample, then run PhotoRec across a disk image containing both the original and the corrupted copy. The original is recovered. The corrupted one is not found at all, because there is no longer a FF D8 FF for the scan to catch.

Where it fits

One practical note for anyone testing this: build the damaged sample locally rather than on a hosted service, since forensic material is exactly the kind of data that should not be handed to a stranger’s server, for the reasons set out in why a file tool should never upload your file.

Carving is a last resort that works surprisingly often. It is also a good mental model for redundancy in general: it succeeds because formats repeat identifying information in predictable places, the same property that lets archive repair tools rebuild an index, as described in how archive repair tools actually work.

Remove that redundancy and every recovery route closes at once.