File carving is the process of reassembling computer files from fragments in the absence of filesystem metadata. The carving process makes use of knowledge of common file structures, information contained in files, and heuristics regarding how filesystems fragment data. Fusing these three sources of information, a file carving system infers which fragments belong together.
File carving is a highly complex task, with a potentially huge number of permutations to try. To make this task tractable, carving software typically makes extensive use of models and heuristics. This is necessary not only from a standpoint of execution time, but also for the accuracy of the results. State of the art file carving algorithms use statistical techniques like sequential hypothesis testing for determining the fragmentation point.
Garfinkel [1] reported fragmentation statistics collected from over 350 disks containing FAT, NTFS and UFS file systems. He showed that while fragmentation in a typical disk is low, the fragmentation rate of forensically important files such as email, JPEG and Word documents are relatively high. The fragmentation rate of JPEG files was found to be 16%, Word documents had 17% fragmentation, AVI had a 22% fragmentation rate and PST files (Microsoft Outlook) had a 58% fragmentation rate. Pal, Shanmugasundaram, and Memon [2] presented an efficient algorithm based on a greedy heuristic and alpha-beta pruning for reassembling fragmented images. Pal, Sencar, and Memon[3] introduced sequential hypothesis testing as an effective mechanism for detecting fragmentation point. Richard and Roussev[4] presented Scalpel, an open-source file carving tool.
File Carving Software
- File carver that is specialized on the recovery of digital movies. Recovery is possible from fragmented files. Current status of this (open-source) program is a proof-of-concept that is suitable for smaller images. In the future much more improved performance can be expected. Further this carver will be extended to support the recovery of fragmented digital images.
- Data carving tools and will recover most know file types. For some formats the files are verified and intelligent names added based on file metadata. Several video formats can be reconstructed from isolated fragments.
- Data carving runs on multiple threads to make use of modern processors
- “Defraser is a forensic analysis application that can be used to detect full and partial multimedia files in datastreams. It is typically used to find (and restore) complete or partial video files in datastreams (for instance, unallocated diskspace).” Written in C#; runs on Windows.
- Simple Carver Suite is a collection of unique tools designed for a number of purposes including data recovery, forensic computing and eDiscovery. The suite was originally designed for data recovery and has since expanded to include unique file decoding, file identification and file classification.
- Foremost is a console program to recover files based on their headers, footers, and internal data structures.
- Scalpel is a fast file carver that reads a database of header and footer definitions and extracts matching files from a set of image files or raw device files. Scalpel is filesystem-independent and will carve files from FATx, NTFS, ext2/3, or raw partitions.
- EnCase comes with some enScripts that will do carving.
- A virtual file system (fuse) implementation that can provide carving tools with the possibility to do recursive multi tool zero-storage carving (also called in-place carving). Patches and scripts for scalpel and foremost are provided. Works on raw and encase images.
- A shared library that allows carving tools to use zero-storage carving on carvfs virtual files.
- midi-carver is a data carver for MIDI files.
- PhotoRec is file data recovery software designed to recover lost files including video, documents and archives from Hard Disks and CDRom and lost pictures (thus, its ‘Photo Recovery’ name) from digital camera memory.
- Datarescue PhotoRescue Advanced is picture and photo data recovery solution made by the creators of IDA Pro. PhotoRescue will undelete, unerase and recover pictures and files lost on corrupted, erased or damaged compact flash (CF) cards, SD Cards, Memory Sticks, SmartMedia and XD cards.
- Revive It (RevIt) is an experimental carving tool, initially developed for the DFRWS 2006 carving challenge. It uses ‘file structure based carving’. Note that RevIt currently is a work in progress.
- Magic Rescue is a file carving tool that uses “magic bytes” in a file contents to recover data.
- FTK2 includes some file carvers
- X-Ways Forensic provides a robust list of file types as well as the ability to specific custom file headers/trailers. File types are available for carving, identification and filtering.
- Adroit Photo Forensics supports data carving of popular image formats. Also supports fragmented carving using SmartCarving and GuidedCarving.
- Belkasoft Forensic Carver and Belkasoft Evidence Center support data carving for Instant Messenger and Browser artifacts. These tools support carving of physical or logical Windows drives as well as popular forensic image formats like Encase Evidence Files, DD or SMART.
Blade™ is a Windows-based, advanced professional forensic data recovery solution designed by Digital Detective Group. It supports professional module plug-ins which give it advanced data recovery and analysis capabilities.
The power and flexibility of the tool can be expanded as new modules become available. Blade supports all of the major forensic image formats and is more than just a data recovery tool. The professional modules have in-built Intelli-Carve™ validation and interpretation routines to assist with accurate data recovery. Some of the standard profiles also have Intelli-Carve™ validated routines (such as the JPEG recovery module).
The software has been designed for extremely fast/accurate forensic data recovery. Not only is it highly effective in the pre-analysis stage of a forensic examination, it can be quickly configured to recover bespoke data formats. It has specifically been written for the field of Digital Forensics.