Data Carving Explained: How Forensic Tools Recover Hidden Data

When a file is deleted, it may disappear from the normal folder view, but its actual data may still remain on the storage device.

If that data has not been overwritten, forensic investigators may be able to find and reconstruct parts of the file.

This technique is called data carving or file carving.

Data carving is a digital forensics technique used to recover files from raw storage by identifying file signatures, headers, footers and internal data structures instead of depending completely on file-system metadata.

This makes data carving forensic tools useful for deleted file recovery, corrupted file systems, formatted drives, damaged partitions, unallocated space and forensic investigations.

But data carving is not magic. Fragmentation, overwriting, encryption, SSD technology and physical drive damage can all affect the recovery result.

What Is Data Carving in Digital Forensics?

Data carving in digital forensics means searching raw storage for recognizable patterns that belong to particular file types.

Normal file recovery may depend on:

• File names
• Folder structures
• File-system records
• Metadata
• Allocation information
• Partition information

When these structures are damaged or missing, file carving in forensics provides another way to search for recoverable data.

For example, a forensic examiner may search for signatures associated with:

• JPEG and PNG images
• PDF documents
• Microsoft Office files
• ZIP archives
• MP3 audio
• MP4 videos
• Database files
• Email artifacts

NIST describes forensic file carving as extracting files based on their content rather than metadata and uses controlled test images to evaluate how carving performs under different fragmentation conditions.

How Does File Carving Work?

The basic concept is simple.

A storage device contains raw bytes. Even when a file is deleted or the file system becomes damaged, some of those bytes may remain.

A simplified forensic file carving process looks like:

Raw storage → File signature → File identification → Data extraction → Reconstruction → Validation

A carving process scans the available data and looks for recognizable patterns.

These patterns can indicate where a particular file starts and, depending on the format, provide information about its structure or ending.

For a simple file, recovery may be relatively easy.

For a fragmented file, the process becomes much harder because different parts of the same file may be stored in different locations.

What Are File Signatures, Headers and Footers?

A file signature is a recognizable sequence of bytes associated with a particular file format.

It is often used by data carving tools to identify possible files inside raw storage.

Headers can help identify the beginning of a file, while other structural information may help determine its boundaries.

For example:

Header → File Data → Footer

However, not every file format has a simple fixed footer.

Modern file formats can have complex internal structures, making professional file carving more than simply searching for a few hexadecimal values.

Data Carving vs File-System Recovery

These are two different approaches to data recovery.

File-System Recovery

File-system recovery uses available file-system information to locate files.

When the file system is healthy enough, it may preserve:

• Original filenames
• Folder paths
• File locations
• Timestamps
• Metadata

Data Carving

Data carving works more directly with raw storage content.

It can be useful when:

• File-system metadata is damaged
• A partition is corrupted
• Directory entries are missing
• Files have been deleted
• A volume cannot be mounted
• Data remains in unallocated space

The major limitation is that a carved file may not retain its original filename, folder path or complete metadata.

In simple terms:

File-system recovery asks:
“Where does the file system say the file is?”

Data carving asks:
“Can recognizable file data still be found?”

Where Is Data Carving Used?

Data carving in digital forensics can be useful in many recovery and investigation situations.

Deleted File Recovery

Deleted photos, documents, videos, emails and archives may remain partially recoverable.

Corrupted File Systems

When normal file-system structures cannot be read correctly, raw-data analysis can provide another recovery option.

Formatted Drives

Formatting can remove important file-system information. Depending on what happened afterward, some underlying data may still be recoverable.

Damaged Partitions

Carving may identify files when partition or directory information is no longer reliable.

Digital Evidence

Investigators can examine forensic images and unallocated areas for artifacts relevant to a case.

Damaged Storage Devices

When a device can be safely imaged, carving can be performed on the forensic image instead of repeatedly accessing a failing original drive.

What Are the Common Data Carving Tools?

There is no single best data carving tool for every case.

Different tools support different file formats, recovery methods, custom signatures, forensic workflows and evidence-processing requirements.

Commonly discussed data carving forensic tools include:

• PhotoRec
• Foremost
• Scalpel
• Autopsy
• FTK
• R-Studio
• X-Ways Forensics

These tools can be useful for different recovery and forensic situations.

For example, signature-based recovery tools can be useful for deleted or corrupted files, while broader forensic platforms can combine carving with searching, metadata analysis, timeline analysis, evidence processing and reporting.

NIST maintains dedicated specifications and testing resources for forensic file-carving technologies, showing why carving results should be evaluated carefully rather than assuming every tool will produce the same result.

Can Data Carving Recover Deleted Files?

Yes, data carving can sometimes recover deleted files.

When a file is deleted, the operating system may mark its previous space as available for reuse.

If the original data has not been overwritten, a carving process may identify and extract it.

However, recovery depends on:

• Overwriting
• File fragmentation
• File-system condition
• Storage technology
• File type
• Encryption
• Physical drive condition

If important data has been deleted, stop unnecessary use of the device.

Continued writing can overwrite data that may still be recoverable. Data Engineers also recommends stopping use of a drive when serious data loss or drive failure occurs.

Data Carving and Fragmented Files

Fragmentation is one of the biggest challenges in file carving.

A simple file might be stored like:

[Header][Data][Data][Data][End]

A fragmented file could look like:

[Header][Part 1] → Other Data → [Part 2] → Other Data → [Part 3]

The recovery process must determine which pieces belong together.

NIST’s forensic-carving test datasets specifically include sequential fragmentation, non-sequential fragmentation, missing fragments, nested files and braided files.

Therefore, finding a file signature does not guarantee recovery of the complete file.

A recovered file may be:

• Complete
• Partially recovered
• Corrupted
• Missing sections
• Structurally invalid

Data Carving on HDD vs SSD

Storage technology also affects forensic data recovery.

HDD Data Carving

Traditional hard drives may retain deleted data until those sectors are reused or overwritten.

But a physically failing HDD should be handled carefully.

Clicking sounds, bad sectors, freezing, slow access and repeated disconnections can indicate a hardware problem.

If your hard drive is not detected, avoid repeatedly scanning or repairing it. Data Engineers’ guide on Hard Drive Not Detected explains why the next steps matter.

SSD Data Carving

SSD recovery is more complicated because modern SSDs can use:

• TRIM
• Garbage collection
• Wear leveling
• Flash translation layers

These technologies can reduce the availability of deleted data.

For serious SSD problems, professional SSD Data Recovery may be required.

Limitations of Data Carving

Data carving has several important limitations.

Overwritten data: If new information has replaced the original data, carving normally cannot recover it.

Fragmentation: Highly fragmented files can be difficult to reconstruct.

Lost metadata: Original filenames and folders may not be available.

Corruption: A recovered file may still be damaged.

Encryption: Finding encrypted data does not mean readable content has been recovered.

Physical damage: Carving cannot repair a physically damaged storage device.

SSD limitations: TRIM and other storage-management processes can reduce recovery opportunities.

When Should You Use Professional Data Recovery?

DIY recovery may be reasonable for a healthy drive with simple accidental deletion.

Professional data recovery services become much more important when:

• The drive is physically damaged
• The hard drive is not detected
• The file system is severely corrupted
• Important deleted files are involved
• The device repeatedly disconnects
• An SSD has failed
• A RAID array has failed
• A server contains critical data
• Digital evidence must be preserved
• Chain-of-custody documentation is required

Data Engineers provides professional data recovery and digital forensics services in India, covering HDD, SSD, RAID, server, NAS/SAN, pen drive, memory card, CCTV and other storage-related cases.

For example, if you are dealing with a damaged RAID investigation, our Damaged RAID Forensics service is relevant.

For corrupted files, see Corrupted Files Data Recovery.

For network storage, see NAS/SAN Data Recovery.

For server failures, see Server Data Recovery.

Data Engineers: Professional Data Recovery & Digital Forensics

Data carving is only one part of a professional recovery process.

At Data Engineers, the recovery approach depends on the type of storage device, failure, data loss and investigation requirement.

Our services include:

• Hard Disk Data Recovery
• SSD Data Recovery
• RAID Data Recovery and Forensics
• Server Data Recovery
• NAS/SAN Data Recovery
• Pen Drive & Memory Card Recovery
• CCTV Footage Recovery
• Corrupted File Recovery
• Ransomware Data Recovery
• Digital Forensics

If your drive is physically damaged, avoid opening or repeatedly scanning it yourself. Data Engineers also handles complex physical-storage recovery cases and uses controlled recovery procedures.

For a broader overview, see our Data Recovery Services.

If your data has already been lost, our guide How to Recover Lost Hard Drive Data explains the first steps you should take.

For encrypted storage, see Encrypted Drive Recovery or our BitLocker Drive Recovery guide.

Conclusion

Data carving is an important technique in digital forensics and professional data recovery.

It can help locate deleted, corrupted or inaccessible files when normal file-system recovery cannot provide the required information.

Tools such as PhotoRec, Foremost, Scalpel, Autopsy and FTK can support different carving and forensic workflows, but no tool can guarantee complete recovery.

The final result depends on the condition of the storage device, overwriting, fragmentation, encryption, file structure and storage technology.

Most importantly, finding a file signature is not the same as recovering a complete file.

If the storage device contains important personal, business or forensic data, avoid unnecessary writes and repeated recovery attempts.

When the case is complex, professional assessment can help protect the original data and determine the safest recovery approach.

Data Engineers provides professional data recovery and digital forensics services in India for HDDs, SSDs, RAID, servers, NAS/SAN, memory cards, USB drives and other storage devices.