Definition - What does File Carving mean?
File carving refers to the reconstruction of computer files that takes place without helpful metadata indicators or other specific guidance. In the absence of this directive information, software systems have to use sophisticated heuristics and probability handling tools in order to successfully reassemble files.
Techopedia explains File Carving
Part of the success of file carving relies on the idea that files that are deleted from a computer or device are not really completely lost until their memory locations are deleted during a device wipeor other fundamental sweeping away of residual data. In many cases, file carving can be part of data forensics, where law-enforcement professionals or other specialized experts can reconstruct files, even after something like a disk formatting, or when the user has effectively deleted the files from a drive. Since many of the fragments of the file may still rest in unallocated memory, they can theoretically be reconstructed.
It’s important to note that other file recovery practices rely on more available system information. By contrast, file carving is largely done based on guesswork, which is why these software systems need advanced features that can more effectively bring order out of chaos.
The VDI Boot Storm: Why It Happens, How to Prevent It
Join thousands of others with our weekly newsletter
Free 30 Day Trial – VMTurbo Operations Manager: