File Carving



The objectives of this chapter are to:


File Carving File Footage File System Structure Contiguous File Forensic Workstation 
These keywords were added by machine and not by the authors. This process is experimental and the keywords may be updated as the learning algorithm improves.


  1. 1.
  2. 2.
    A. Pal and N. Memon. The evolution of file carving. IEEE Signal Processing Magazine, vol. 26, no. 2, pp. 59-71, March 2009Google Scholar
  3. 3.
    Z. Lei. Forensic analysis of unallocated space. Master’s Thesis, University of Ontario Institute of Technology, 2011Google Scholar
  4. 4.
    C. Beek. Introduction to File Carving. McAfee White Paper. Available at:
  5. 5.
    Guidance Software. Investigations of individuals. Available:
  6. 6.
    X. Lin, C. Zhang, T. Dule. On Achieving Encrypted File Recovery. In: X. Lai, D. Gu, B. Jin, Y. Wang, H. Li (eds) Forensics in Telecommunications, Information, and Multimedia. e-Forensics 2010. Lecture Notes of the Institute for Computer Sciences, Social Informatics and Telecommunications Engineering, vol 56. Springer, Berlin, HeidelbergGoogle Scholar
  7. 7.
    File carving - forensics wiki. Available:
  8. 8.
    Digital Forensics Research Workshop 2005.
  9. 9.
    S. L. Garfinkel. Carving contiguous and fragmented files with fast object validation. Digital Investigation, vol. 4, pp. 2-12, 2007CrossRefGoogle Scholar
  10. 10.
    A. Pal, H. T. Sencar and N. Memon. Detecting file fragmentation point using sequential hypothesis testing. Digital Investigation, vol. 5, pp. S2-S13, 2008CrossRefGoogle Scholar
  11. 11.
    G. Richard and V. Roussev. Scalpel: A Frugal, High Performance File Carver. DFRWS 2005 USAGoogle Scholar
  12. 12.
    Y. Wei, N. Zheng, and M. Xu. “An Automatic Carving Method for RAR File Based on Content and Structure”, Second International Conference on Information Technology and Computer Science, 2010, pp. 68-72Google Scholar
  13. 13.
    M. Chen, N. Zheng, X. Xu, Y.J. Lou, and X. Wang. “Validation Algorithms Based on Content Characters and Internal Structure: The PDF File Carving Method”, International Symposium on Information Science and Engineering, Dec. 2008, vol. 1, pp. 168-172Google Scholar
  14. 14.
  15. 15.
  16. 16.
    “TestDisk - Partition Recovery and File Undelete”,, 2017. [Online]. Available: [Accessed: 06- Apr- 2017]
  17. 17.
    “PhotoRec - Digital Picture and File Recovery”,, 2017. [Online]. Available: [Accessed: 06- Apr- 2017]
  18. 18.
  19. 19.
    Digital Forensics Tool Testing Images.

Copyright information

© Springer Nature Switzerland AG 2018

Authors and Affiliations

  1. 1.Department of Physics and Computer Science, Faculty of ScienceWilfrid Laurier UniversityWaterlooCanada

Personalised recommendations