The platters and actuator heads of a hard drive.
Data carving is an advanced data recovery technique that extracts files directly from the raw bits and bytes on a storage device. It’s an option when the storage device’s file system is missing, corrupt, or otherwise inaccessible.
Ideally, data carving should be a last resort — where possible, engineers should repair the directory structure of the device. That’s not always an option, however, and for certain types of data loss scenarios involving smaller files, data carving may be a viable option.
This article will explain how data carving works (and its limitations). If you’ve lost data due to a hard drive failure, SSD corruption, ransomware infection, or for any other reason, we’re here to help. Datarecovery.com provides risk-free evaluations, and our no data, no charge guarantee gives you peace of mind as your case progresses.
To learn more, call 1-800-237-4200 or set up a free evaluation online.
Understanding the Role of the File System
In simple terms, a file system is a detailed record of every file on a storage device. The architecture of the file system varies depending on the operating system and the user’s preferences. On Windows machines, the most common file system is NTFS; on macOS, APFS is the most common option.
When you ask your computer to open a document, the operating system consults the file system, finds the file’s location, and reads the data.
When a drive is formatted or the file system becomes corrupt, the operating system can’t find the data that makes up your files. In many cases, the data still exists — there’s just no “map” that the computer can follow to find the bits that make up the file.
The Data Carving Process, Explained
Data carving works by bypassing the missing file system and searching the raw data for patterns. .
This process relies on file signatures, which are unique strings of data that mark the beginning and end of specific file types. For example:
- A header is the signature that identifies the start of a file. For example, a JPEG image file always begins with the hexadecimal values FF D8 FF E0.
- A footer is the signature that marks the end of a file. For a JPEG, this is FF D9.
We’re using JPEGs as an example for a reason — image files are generally good candidates for data carving, since they’re relatively small and predictable.
In our laboratories, we’ve developed carving software specifically designed for certain types of files. When the software finds a known header, it begins extracting the data. It continues copying data until it either finds the corresponding footer or reaches a predefined maximum file size.
This is how many data recovery software applications operate, by the way — but experienced engineers can make the process a bit more precise (and therefore successful) by leveraging their experience with certain types of files and their understanding of data architecture. Accurate data carving requires some amount of human judgment.
Note: We strongly recommend consulting with professional data recovery technicians before using data recovery software. Learn why we advise against using consumer data recovery software.
Data Carving: Challenges and Limitations
Data carving isn’t a perfect solution to data loss. If it were, file system corruption wouldn’t be a big deal — but unfortunately, that’s not the case.
Some of the limitations of data carving include:
- File Fragmentation: Hard drives rarely store files as single, contiguous blocks of data. A fragmented file is split into pieces and stored in different physical locations. Because basic data carving reads data sequentially from the header, it will only recover the first piece of a fragmented file, resulting in a partial or corrupt file.
- Loss of Metadata: All the original file names, folder structures, creation dates, and timestamps are stored in the file system. Since data carving bypasses the file system, this information is permanently lost unless the file contains its own embedded metadata. You will get your files back, but you will have to manually rename and reorganize them.
- False Positives: Sometimes, random data on a drive can coincidentally match a known file header, so software might “carve” a block of junk data that is unusable.
- Encrypted and Compressed Files: Carving is generally ineffective on encrypted volumes, as the underlying data is scrambled and contains no recognizable headers. It can also struggle with certain proprietary or complex compressed file formats.
Of these issues, file fragmentation is the most significant from a data recovery perspective. Depending on the file type, a partial recovery may be useless. We structure our no data, no charge guarantee so that our clients don’t pay for failed attempts — that includes partial recoveries that don’t contain anything useful or usable.
When Do Data Recovery Engineers Carve Data?
Data carving is an essential technique for specific data loss scenarios. For example:
- Accidental formats.
- Severe file system corruption.
- Accidental deletion from Recycle Bin or Trash.
- Physical storage device failures where only a partial raw image of the drive could be created.
Data carving is also a fundamental tool in digital forensics, where investigators use it to find file fragments and evidence that have been intentionally deleted. Learn more about the differences between data recovery and digital forensics.
Expert Solutions for Advanced Data Recovery
At Datarecovery.com, we use proprietary, purpose-built systems that employ sophisticated carving algorithms capable of reassembling fragmented files. More importantly, our engineers understand the relationship between file systems and raw data. They’re adept at choosing appropriate techniques for each data loss scenario — and modifying the recovery plan as-needed to provide the best possible results.
If you’re facing data loss from a formatted or corrupted device, schedule a free evaluation. Contact Datarecovery.com at 1-800-237-4200 to speak with an expert or submit a case online.
