Hello, you are using an old browser that's unsafe and no longer supported. Please consider updating your browser to a newer version, or downloading a modern browser.
Training Camp • Cybersecurity Glossary
File carving recovers files from raw disk images using signatures and structure rather than filesystem metadata, key for recovering deleted forensic evidence.
File Carving Definition: File carving recovers files from raw disk images using signatures and structure rather than filesystem metadata, key for recovering deleted forensic evidence.
File carving is a digital forensics technique that recovers files from raw storage or disk images by identifying file signatures, headers, footers, and internal structure rather than relying on filesystem metadata. It is essential when file tables have been deleted, corrupted, or formatted, and for recovering data from unallocated space or slack space. Advanced carving handles fragmented files and uses content-based validation, though fragmentation and overwritten sectors can limit recovery success.
Turn knowledge into credentials with our instructor-led cybersecurity boot camps.
View All Courses →