Carving 12,000 JPEGs From Unallocated Space
A 500 GB NTFS image from a laptop is being examined in a fraud case. Analysis shows approximately 180 GB of unallocated space and an $MFT with 40,000 entries, many marked as deleted but not overwritten. You run PhotoRec across the unallocated space and recover 12,000 JPEGs, plus 3,000 embedded thumbnails, many duplicates and truncated files. The case theory involves photographs of a meeting that the suspect denies attending. There are no timestamps on the carved files, no filenames, and some images appear fragmented. The $MFT contains records for files named IMG_20240315_*.jpg with cluster runs that may still be recoverable. The prosecutor wants a report in five days listing 'all photos from the meeting,' and opposing counsel has retained an examiner who will challenge your method.
1. How do you triage the carve output and establish which files are evidentiary? Address false positives, thumbnails, and the absence of timestamps.
Read the worked answer
Do not start with the 12,000 generic carves. Start with the file system metadata, then use carving to fill gaps.
MFT-first recovery
- Parse the $MFT for deleted entries, especially the IMG_20240315_* records. Recover $FILE_NAME, $STANDARD_INFORMATION timestamps, and the data run list.
- Use the data runs to extract clusters directly; this preserves the original filename, timestamps, and cluster layout, which generic carving cannot.
- Check $UsnJrnl and $LogFile for deletion and rename records.
Then triage the generic carves
- Deduplicate by SHA-256; remove files matching known-good hash sets.
- Filter by resolution to eliminate thumbnails and icons; inspect embedded EXIF for camera model and timestamps where present.
- Validate each candidate: correct SOI/EOI markers, successful decode, plausible dimensions, and no truncation.
- Use perceptual hashing to cluster near-duplicates and to match carved images against Windows Thumbcache or thumbs.db entries, which may link an image to a filename and folder.
- Compare output from a second carver; files found by both are stronger candidates.
On timestamps: carved files have none. Say so. The evidentiary value comes from MFT timestamps, thumbnail-cache linkage, and corroborating artifacts, not from the carve itself. Document the method, the tool versions, the deduplication counts, and the criteria for inclusion and exclusion.
2. A carved JPEG appears to be fragmented across three non-contiguous clusters. How do you detect and handle it, and what is the risk of reporting it?
Read the worked answer
Fragmentation is where carving most often produces a plausible but false image.
Detection
- The file decodes partially, lacks a proper EOI marker, has implausible dimensions, or shows entropy discontinuity at a cluster boundary.
- Many carvers stop at the first FFD9 they encounter; that EOI may belong to an embedded thumbnail, producing a truncated image that looks valid at low resolution.
- Compare the file's cluster sequence with the $MFT data run list if a deleted MFT record exists. If the runs point to non-contiguous clusters, reassemble using the MFT runs rather than the carver's assumption of contiguity.
Handling
- Use a fragmentation-aware tool or manually reconstruct the cluster chain, then validate the complete JPEG with a parser and visual inspection.
- Record every step, including any clusters that were missing or filled.
Risk
- A mis-joined image can depict a scene that never existed as a single file, which is catastrophic under cross-examination and ethically improper to present as original.
- If reconstruction is necessary, label it as a reconstruction, state the cluster chain and the basis for the joins, and do not present it as the recovered original unless the MFT runs confirm it.
- Prefer reporting the un-reconstructed fragments or the MFT-confirmed extraction, and describe the fragmented carve as an intermediate work product.
3. How do you report the carved findings so they survive a Daubert-style challenge?
Read the worked answer
Make the method transparent, bounded, and reproducible.
Report content
- State the tools, versions, settings, and the order of operations: MFT recovery, then generic carving, then filtering.
- Provide counts at each stage: total carved, duplicates removed, thumbnails excluded, candidates validated, and final evidentiary set.
- Hash every output file and preserve the carve logs and the source image.
- Describe validation: decoding checks, a second tool, perceptual-hash clustering, and thumbnail-cache linkage.
- State limitations explicitly: unallocated space cannot establish who created a file or when; carved files have no timestamps; fragmented reconstructions are reconstructions.
Framing conclusions Say "N images consistent with the meeting, recovered from MFT records bearing timestamps of 2024-03-15 and corroborated by thumbnail-cache entries," not "all photos from the meeting." Distinguish images recovered with metadata from images known only as carved data.
Anticipate the challenge Opposing counsel will attack false positives and fragmentation. Show a control: known test images carved under the same settings, and a sample of excluded files with reasons. Explain error rates as they apply to your workflow, not just the tool. Offer the raw output for independent review. If the evidence cannot support the prosecutor's requested phrasing, say so in writing; the report must survive cross-examination, not just please the client.