What is the File Carving process used by digital crime experts to retrieve data?

When we delete files from our computer or device, they are not completely lost until memory locations are deleted while the device is being scanned. Many of the fragments are still in unallocated memory and can be reconstructed theoretically. In a simpler way, most file systems do not erase the data completely, but rather remove it.

File Carving process used by digital crime experts to retrieve data

What is File Carving?

file carving is a process used in computer-related criminal sciences to extract data from a disk drive or other storage device without having to help the file system that originally created the file. It is also a way to recover files with an unallocated space without any file information. The process is called "carving", a general term for extracting structured data from raw data based on the format of the specific properties shown in the structured data.

Tools File Carving

The File Carving tools use various tags, such as headers and footers, in an attempt to select parts of the file. This program relies on inference tools and the possibility of collecting the required files successfully. In addition, advanced algorithms help improve file recovery results.

Although File Carving largely depends on guesswork, if we use the right tool with advanced features and capabilities, the results of file recovery will greatly improve and help to output these files or data as they were.

Best Tools File Carving

1. EVTXtract
If you are primarily looking for logs from Microsoft, EVTXtract is ideal for you. It brings together the best available tools, which recovers and reconstructs EVTX log files from raw binary data, memory image, and unallocated space.

If you're not familiar, EVTX records will be available in one of the most common formats, but it's still easy to recover. This is because these files are encrypted using Microsoft's proprietary binary XML representation, and rely on records that are located nearby. However, when dealing with a damaged or unallocated space, the recovery process must go through several stages.

EVTXtract is actually a Python script, you can run it easily on any platforms such as Windows, Linux and MacOS.

2. bulk_extractor
bulk_extractor is another File Carving tool that scans directory files and disk image and extract useful information without analyzing file system or file system structures. It can provide output stream for many types of files including domain.txt, ccn.txt, ether.txt, exif.txt, find.txt, etc.

This tool has many basic and advanced capabilities, because it ignores the structure of the file system, the bulk_extractor provides unparalleled speed and accuracy when compared to others.

The program divides the disk into 16 MB and processes one page on each available kernel. This basically means that 24-core devices handle a disk 24 times faster than a single-core device. However, bulk_extractor automatically detects compressed data and decompresses it and recovers it frequently using a variety of advanced algorithms. It is available for Windows and Linux systems.

3. Scalpel
Scalpel is also a good application for File Carving and indexing for Windows and Linux systems. It was initially released in 2005 based on Foremost 0.69. After a number of versions, its features have improved significantly.

Talking about the new generic version v2.0, it comes with less carving sizes, support for regular expressions headers / footers, and multithreading to perform faster on multi-core CPU, ect. Even able to handle organized file types that contain embedded files.

This File Carving tool relies on identifying patterns that describe specific types of file or data segments. Styles can be based on binary strings or regular expressions. If you are interested, you can find the number of default styles in the configuration file included in scalpel.conf.