Deleted File Recovery and File Carving
Deleted File Recovery and File Carving
This domain tests recovery from file-system metadata and reconstruction from unallocated space. The examiner must distinguish recovery from carving and validate every result.
Core rules
- Metadata-based recovery uses FAT directory entries or NTFS MFT records. Check allocation status, data runs, and $Bitmap; confirm whether clusters were reused.
- Carving searches unallocated space for file signatures, headers, footers, and structural validation. It can recover content without metadata but often loses names, times, and paths.
- Fragmentation can break carved files. Use sector maps, manual reconstruction, and file-type validation.
- Examine file slack, volume slack, and unallocated space separately. SSD TRIM and encryption can eliminate recoverable content.
- Validate carved files by opening them, checking internal structures, and hashing. Document offsets and tool settings.
Worked example
A JPEG is carved from unallocated space using header FF D8 FF and footer FF D9. The examiner validates EXIF and opens the image. A second fragmented JPEG fails validation, so it is reported as a partial carve with its offset and limitation. Claiming both are complete files would overstate the result.
Traps
Claiming all carved files are relevant; not verifying carved output; assuming deleted means recoverable; ignoring file-system metadata; carving allocated space and calling it deleted data.
Key points
- Metadata recovery and carving answer different questions.
- Check cluster reuse before claiming recovery.
- Validate carved files structurally and visually.
- Fragmentation limits carving success.
- Document offsets, tool settings, and partial results.