Digital Forensics
Private Investigator
Learn More
Contact Us

File Carving

Digital file carving is not entirely unlike finding the image in traditional carvingIn many respect, file carving is the heart of computer forensics examination. Digital forensic tools can help automate the process, but it frequently comes down to the skills and training of the analyst. File carving involves a bit-by-bit analysis of the contents of a hard drive, searching for remnants of files which have been marked for deletion.

Computers store information in sectors and clusters, but these clusters may be scattered in many different locations on the hard drive. Fragments of partially-overwritten files may also exist within allocated clusters.

Related files will often have identical metadata within file headers, which help us to identify which fragments may be important, which ones we can ignore and which fragments fit together. Once we identify fragments which may have come from the same file, forensic recovery becomes a digital jigsaw puzzle working out how they should fit together.

File carving is a painstaking process, but the time taken can be very rewarding. When we recover a deleted file, photo or e-mail it can give us definitive evidence confirming or refuting the suspicions of our clients.

 

Back To Glossary

Private Investigator Services  |  Digital Forensics  |  Find Out More  |  Contact

Call Us Today 414-377-8207


CONFIDENTIALITY DISCLAIMER All information obtained during the course of an investigation will remain confidential and solely between the investigator, Spindletop Investigations, LLC, and the client. However, private investigators are legally required to report any instances of child pornography or sexual crimes against children. Spindletop Investigations may choose to report other potentially serious crimes if they involve the risk of the loss of life. Spindletop Investigations will not pursue any unrelated leads outside the agreed upon scope of the investigation. As part of the consultation, Spindletop Investigations will work with the client in advance to fully define the scope of the investigation as well as all legal exceptions to our confidentiality agreement.

© Spindletop Investigations. Milwaukee, Wisconsin  |  Site map