Chapter 7 — Key Takeaways

The big idea

When the file system's map is destroyed — reformatted, repartitioned, overwritten, corrupted — the data still sits in the raw sectors, and file carving recovers it by its content rather than its metadata. A carver ignores the file system entirely and scans the bytes for the signatures (magic numbers) that mark the start of known file types, and where the format provides one, the footer that marks the end. From a header and a footer you reconstruct a file with no file-system involvement at all. That power comes at a price that defines everything about how you use a carved file: it arrives stripped of every piece of context the file system held — no name, no folder, no owner, no timestamps. Carving proves content existed on the media; it does not, by itself, prove when, who, or where.

The signatures you will read for the rest of your career

The full table is Appendix A; memorize the top handful.

A footer of "none reliable" is the common case — TIFF, MP4, OLE2 .doc, RAR, 7-Zip, GZIP, EXE all lack one. And 50 4B 03 04 is everywhere: DOCX, XLSX, PPTX, JAR, APK, ODT, and EPUB are all ZIP underneath, so "found a ZIP" needs a look inside ([Content_Types].xml) to become "found a DOCX."

Three strategies, and the smarter fourth

• Header-and-footer — find header, scan to next footer, carve between. Byte-perfect on contiguous JPEG/PNG/GIF. The gold standard.
• Header-and-maximum-size — for footer-less formats; carve a capped length and trim later.
• Header-only — crudest fallback; most junk and truncations.
• Smart carving (object validation) — understand the format: follow PNG chunks and their CRCs, read a ZIP's central directory, parse JPEG markers to skip the embedded thumbnail, walk MP4 box sizes. Validation computes exact lengths, kills false positives, fixes the nested-footer truncation, and tests fragment reassembly. PhotoRec is built on it.

Know your limits (state them before you start)

• Fragmentation defeats linear carving — the big one; non-contiguous files come out spliced and corrupt. Bifragment gap carving rescues some two-fragment cases; three-plus in arbitrary order generally cannot be reassembled by content alone.
• No distinctive header, no carve — plain text, CSV, many logs (use bulk_extractor for content instead).
• Compressed / encrypted data looks like noise — no visible structure to find.
• Overwritten is gone — carving recovers what persists, not what new data replaced.
• TRIM may have already zeroed an SSD's unallocated space — carve after a delete and you may find nothing (Chapter 9).
• A carved file has no file-system context — by definition; that is what "had to carve" means.

The tools

PhotoRec (validate-as-you-go, default) · Foremost and Scalpel (fast, transparent, configuration-driven signature carvers; read their audit.txt) · bulk_extractor (a feature scanner that finds emails, URLs, CCNs, and EXIF/GPS in fragments too small to be files). Run more than one; agreement corroborates.

You can now…

• ☐ Explain why files survive a format or partition loss and recover them by content when the file system map is gone.
• ☐ Recognize the major headers and footers in a hex dump and choose header-and-footer, header-and-max-size, or header-only carving appropriately.
• ☐ Isolate unallocated space (blkls) and carve it with PhotoRec, Foremost, Scalpel, and bulk_extractor, reading and writing a *.conf and an audit.txt.
• ☐ Triage thousands of carves down to the ones that matter using internal metadata (EXIF dates, dimensions, authorship).
• ☐ Document a carve to forensic standard — source hash, tool/version/config, offsets, per-file hashes — and state honestly what a carved file does and does not prove.

Looking ahead

Chapter 8 — Hard Drive Recovery. So far the data has been intact and only the map was the problem. Next the drive itself is the problem: clicking heads, seized spindles, dying boards. You will learn to read failure symptoms, decide when a drive belongs in a clean room and when it must never be powered on again, and image a dying patient with ddrescue so the logical and carving techniques of these two chapters even have an image to work on.

One sentence to carry forward: Carving trades the context the file system held for the content the file holds about itself — you lose the name and the date the volume recorded, but you keep the picture, and the camera's own memory of when it was taken.