data carving tools

Data carving (also called file carving) is a digital forensics technique that recovers files directly from raw data, without relying on the file system. Carving tools scan a disk, memory dump or disk image for known file signatures, the header and footer “magic bytes” that mark where a JPEG, PDF or ZIP file begins and ends, and rebuild the files in between. This makes it possible to recover evidence from formatted drives, unallocated space and corrupted partitions where normal recovery fails.

Popular carving and recovery tools include PhotoRec, Scalpel, Foremost, Autopsy (which uses PhotoRec as a module), Bulk Extractor for feature extraction, and commercial suites such as X-Ways Forensics and SalvationDATA VIP. Carving works best on files stored in one continuous block; heavily fragmented files are harder to recover intact.

Compare the top options in our guide to the 7 best data carving tools, and explore tutorials for each tool on Cracking Station.