What is Data Carving?
By Matt Brennan
Data carving, sometimes known as file carving, is a term often used within the fields of data recovery and cyber forensics.
When data is extracted from undifferentiated blocks of raw data, it is known as data carving. It’s a term that can also be used to describe the act of file identification and recovery based on an analysis of file formats. This technique is helpful to find hidden or deleted files within digital media.
Sometimes a file that appears lost to the owner of the data may be hiding in lost clusters, unallocated clusters, or slack space within the digital media. If the file has a standard file header, a search can be performed to locate the header, and continued to the footer (the end of the file). That data can be extracted to validate the file. There may be different methods used for data carving depending on the format of the file in question.
Recovering Lost Data is a Difficult Task
When data is lost from a hard drive or disk, it can become incredibly complex to recover. An industry has built up around providing free and paid software for this task on various machines. This software can be risky however, because the simple act of installing it to your computer may be all it takes to write over the file in question and lose it.
Once the data is corrupted because of the condition of the drive, it can become impossible to recover in many circumstances. This is why the best course of action is to hire a professional data recovery company, for the best chance of seeing that information again. Data carving is a complex technique frequently used by these companies to help retrieve your file.
Where Data Carving Factors In
Data carving is simply the reassembling of data in an unallocated space, typically either unused disk space or reused disk space. It operates based on file system contents rather than the metadata and file structure.
The system will treat both unused disk space and reused disk space as free space. Reused disk space is the empty space in a new partition, that was previously used by a different partition. This type of space may still contain some file data, even without the metadata. Because of this, data carving may be the only way to effectively recover lost data in these circumstances.
Two Scenarios for Data Carving
- To recover lost or damaged files due to missing or corrupted directory entries
- To recover deleted files
In both scenarios, success depends on the condition of the drive that’s in question. A file system won’t rid itself of a deleted file right away. The fragments of the drive where that file is stored might eventually be marked as free space within the system. Because of this, the data that is deleted remains on the drive until it is overwritten by another file.
There are many different types of tools that can be used by a data recovery company for data carving. If you have lost data on a drive, contact We Recover Data today and one of our technicians can help!
