File Carving

Tags

security

An [see page 6, approach] for extracting data from a storage device without the assistance of the file-system. Consider being given a file-system as just a massive BLOB with no known file-system info. We can look for file signatures to find file information, even without knowledge of how the file-system is structured.

This approach is effective at recovering files in unallocated space (such as the deleted files space) where file-information doesn't exist.