Recovering Data: Deleted Files and File Carving

What you'll be able to do

By the end of this lesson you will be able to explain how deleted data can be recovered, and how much a recovered item can be trusted.

• Explain what actually happens when a file is deleted.
• Distinguish deleted-file recovery from file carving, and say when each is used.
• State the limits of recovered data in a report.

What Deletion Really Does

The book defines data recovery as retrieving lost, deleted or corrupted data from storage devices or systems. To understand why recovery is possible, you need to know what deletion does.

• The Recycle Bin is not deletion. A file "deleted" to the Recycle Bin is simply moved there and can be restored with a click. The Recycle Bin is a classic place to look (Lesson 2.5).
• Emptying the bin usually removes the entry, not the contents. When a file is deleted from the file system, the system marks its record and its space as free to reuse. Microsoft's documentation of NTFS puts it plainly: when files are deleted, their Master File Table entries are marked as free and may be reused. Until new data is written over that space, the old contents are still physically there.

That is why both techniques below work only on data that has been deleted but not yet overwritten. And it is why Lesson 2.3's SSD warning matters: on solid-state drives, TRIM and garbage collection may erase freed space by themselves.

Technique 1: Deleted-File Recovery

If the file system's record of a deleted file still exists, for example an NTFS entry marked as free but not yet reused, a forensic tool can read it and recover the file with its name, size, dates and location, as long as the data has not been overwritten. This is the cleanest kind of recovery, because the metadata tells you exactly what the file was. In FTK Imager and Autopsy, recoverable deleted files are flagged in the file list.

Technique 2: File Carving

Sometimes the file system's records are gone: the drive was reformatted, the entry was reused, or the file system is damaged. File carving ignores the file system and searches the raw data itself, especially unallocated space, for recognizable structures. The book describes it as extracting data fragments from unallocated or deleted portions of a disk.

Carving relies on what you learned in Lesson 2.2: file signatures. A carving tool scans for known headers, such as FF D8 FF at the start of a JPEG image, and where possible a matching footer (FF D9 marks the end of a JPEG), then extracts everything in between as a candidate file.

Carving has real limits:

• No names or dates. The metadata lived in the file system records, which are gone. Carved files are usually given generated names such as f0012345.jpg.
• Fragmentation. If a file was stored in pieces scattered across the disk, a simple carve may produce a partial file, or join pieces of different files together.
• Volume. Carving a large drive can produce many thousands of items, most of them irrelevant.

Free tools that carve include PhotoRec, an open-source recovery program that ignores the file system and works at the data level, and Autopsy, which includes a PhotoRec carver module (Lesson 5.4).

How Far Can Recovered Data Be Trusted?

NIST's 2022 scientific review of digital investigation techniques gives a clear warning: when techniques are used to recover deleted or hidden artifacts, the examiner must determine the relevance of what was recovered, because it may be incomplete or improperly merged with irrelevant information. A recovered fragment is a lead that must be checked, not an automatic fact. A good report says exactly how each item was recovered, and what is not known about it, such as when it was created or deleted, or by whom.

Real-World Example

Imagine (a fictional scenario) a photographer whose memory card was "accidentally" formatted. She asks a forensic data-recovery service for help. The examiner images the card, then runs a carving tool over the image. It finds 1,840 JPEG headers. Most carve cleanly into complete photos. Thirty-two come out as partial images, top halves followed by grey or garbled blocks, because those photos were stored in fragments. The examiner delivers the complete photos, flags the partial ones, and explains that their names and original dates could not be recovered, although many photos carry their own date inside their internal metadata (Lesson 7.1 returns to metadata).

From the Book to 2026

What the book teaches. Data recovery uses file carving to extract fragments from unallocated or deleted space, and deleted-file recovery for files deleted but not yet overwritten.

Why it made sense. These remain the two core recovery techniques, and on magnetic drives they are often very successful.

What has changed. Three things limit recovery more than before. Solid-state storage: TRIM and garbage collection can erase freed space, and results vary by device and over time. Encryption by default: carving an encrypted volume without its key produces only meaningless data. Anti-forensic tools that overwrite free space are easy to obtain. Meanwhile, NIST's 2022 review sharpened how recovered items should be treated: they may be incomplete or merged with unrelated data, so the examiner must evaluate each one.

What to do now. Attempt recovery on a verified image, never on the original. Report the method behind every recovered item, flag partial or carved items clearly, and never present a carved fragment as more than it is.

Watch: How to Recover Data

This DFIRScience lesson, part of a free introductory digital forensics course by a digital forensics academic, explains the theory of data recovery.

Questions to keep in mind as you watch:

• What is the difference between recovering a file through the file system and carving it from raw data?
• Why do file signatures make carving possible?
• What could make a carved file incomplete or misleading?

The video complements what you just read. The lesson is complete without it.

What Would You Do?

Carving an image of a suspect's laptop produces a partial document that contains half of a threatening letter. Its name is f0458812.doc and it has no dates. The case officer wants your report to say "the suspect wrote this letter on his laptop". What will your report actually say? Decide, then compare with the model answer in the note below.

Knowledge Check

Key Takeaways

• The Recycle Bin is not deletion. True deletion marks a file's record and space as free, so contents remain until overwritten.
• Deleted-file recovery uses surviving file-system records and keeps names and dates. File carving uses file signatures in raw data and loses them.
• Carved and recovered items may be partial or merged with other data: evaluate each one before relying on it.
• SSDs, encryption and wiping tools make recovery less certain than it used to be.

Sources

• Dr. Tahseen Al-Doori — IT Forensics Essentials: Concepts, Tools, and the Practice of Digital Investigation, Chapter 5 (b)
• Microsoft Learn — Master File Table (Local File Systems)
• NIST — IR 8354: Digital Investigation Techniques: A NIST Scientific Foundation Review (November 2022)
• CGSecurity — PhotoRec
• Autopsy User Documentation (ingest modules, including the PhotoRec Carver module)
• GCK's File Signatures Table (Gary Kessler, hosted by SEARCH)
• arXiv — Hadi, Ullah and Harris, SSD Forensic: Evidence Generation and Forensic Research on Solid State Drives Using Trim Analysis (2023)