From the course: CompTIA Advanced Security Practitioner (CASP+) (CAS-004) Cert Prep

Unlock this course with a free trial

Join today to access over 24,900 courses taught by industry experts.

File carving tools

File carving tools

From the course: CompTIA Advanced Security Practitioner (CASP+) (CAS-004) Cert Prep

Start my 1-month free trial Buy for my team

File carving tools

“

- In this lesson, we're going to discuss file carving. File carving is a process used in digital forensics to extract data from a disc drive or other media when the file system is unavailable. File carving is useful in recovering data that was hidden in the slack space or unallocated space of a disc image too. When a file is deleted from a hard drive or storage device by the user, it isn't actually erased from that drive, but instead the pointer to the file's location in the master file table is going to be erased. This means that the hard drive no longer knows how to access that file because the metadata about its location has been erased, and this tells the hard drive that that space is now free and available to have other files written into that space. This space is now considered part of the slack or free space of that file system. Our job as a forensic analyst is to find deleted files and restore them if they contain evidence of a crime. So to recover these files, the data is…

Contents