What is file carving in digital forensics?

• A. Deleting files securely
• B. Encrypting files on disk
• C. A technique to recover files or fragments by identifying file signatures
• D. Compressing large files

Answer: (C)

File carving in digital forensics is the process of recovering files or their fragments by scanning the raw data for known file signatures (magic numbers) and then reconstructing the file boundaries. This approach doesn’t rely on the file system’s metadata, so it’s useful when the file system is damaged, missing, or when files have been deleted and their directory entries are gone.

The technique looks for start and end markers of different file types and can piece together fragments that are dispersed across the storage medium, sometimes reconstructing a complete file from noncontiguous data blocks. For example, JPEGs have recognizable markers at the beginning and end, PDFs start with a distinct header, and PNGs begin with a specific byte sequence.

Limitations exist: data can be misinterpreted if multiple files share similar signatures, and encrypted or highly compressed content may not reveal clear signatures to carve. Also, carved files can be incomplete or corrupted if the fragments aren’t properly reconstructible.

This approach is distinct from securely deleting data (which overwrites it), encrypting data (which hides content), or compressing data (which reduces size but isn’t about recovering files from raw data).