ATTENTION: The new home of the Digital Forensics Wiki is at Yeah, it's a silly name, but it was cheap.
This wiki will be going offline permanently in the near future. An exact date will be announced soon. Thank you for being a part of this community.
If you wish to work on the new forensicswiki, please join the Google Group forensicswiki-reborn

File Carving

From ForensicsWiki
Revision as of 22:44, 2 May 2006 by Jessek (Talk | contribs) (Initial description)

(diff) ← Older revision | Latest revision (diff) | Newer revision → (diff)
Jump to: navigation, search

File carving is the practice of searching an input for files based on their headers and/or footers. Most often the input is a disk image, but it's possible (and sometimes practical) to carve individual files.

Many carving programs have an option to only look at or near sector boundaries where headers are found. Searching the entire input can find files that have been embedded into other formats, such as JPEGs being embedded into Microsoft Word documents or files stored in a ZIP archive.