Practical Mobile Forensics - Third Edition

Recovering files using file-carving techniques

File carving is an extremely useful method in forensics because it allows data that has been deleted or hidden to be recovered for analysis. In simple terms, file carving is the process of reassembling computer files from fragments in the absence of file system metadata. In file carving, specified file types are searched for and extracted across the binary data to create a forensic image of a partition or an entire disk. File carving recovers files from the unallocated space in a drive based merely on file structure and content without any matching file system metadata. Unallocated space refers to the part of the drive that no longer holds any file information indicated by the file system structures, ...