File Recovery Fragments: What It’s Called & How It Works

Recovering fragments of a file is called file carving (or data carving). It is a forensic technique that reassembles files from raw data blocks on a storage device without relying on the file system’s metadata, such as the file allocation table or directory entries. This article explains what file carving is, how it works, when it’s used, and its limitations.

Formula

The calculator above estimates the probability that a deleted file’s data has been overwritten, based on time since deletion and storage size. The formula is a rough heuristic:

P = min(100, (T × S) / 100)

• T = time since deletion (hours)
• S = storage size (GB)
• P = overwrite probability (%)

This is not a physical law; it’s a practical guide to illustrate that larger drives and longer wait times increase the chance of overwrite. Real overwrite probability depends on write activity, not just capacity.

Worked Example

Using the default values: T = 24 hours, S = 256 GB.

1. Multiply T × S = 24 × 256 = 6144
2. Divide by 100: 6144 / 100 = 61.44
3. Take min(100, 61.44) = 61.44

The calculator shows 61.4%, meaning after 24 hours on a 256 GB drive, there’s an estimated 61.4% chance the deleted file’s fragments have been overwritten. This is a simplification; actual results vary widely.

What Is File Carving?

File carving is the process of extracting files from raw storage media by identifying file signatures (magic numbers) and reassembling the data. Unlike normal file recovery, which uses the file system’s metadata to locate files, carving works even when the metadata is damaged, formatted, or deliberately deleted.

The term “fragments” refers to the pieces of a file that may be scattered across different physical locations on a hard drive or SSD. When you delete a file, the operating system typically only removes the pointer to it, leaving the actual data in place until it’s overwritten. Carving finds those data blocks and stitches them back together.

How File Carving Works

File carving relies on two main techniques:

• Header/Footer carving: Scans for known file signatures (e.g., JPEG starts with FF D8 FF, PDF starts with %PDF) and then reads until a footer signature or a maximum file size is reached.
• Content-based carving: Uses internal file structure (like JPEG’s segment markers or ZIP’s central directory) to determine where the file ends, even if the footer is missing.

For fragmented files, advanced tools use fragment point detection – they analyze the statistical properties of data blocks to guess which blocks belong to the same file. This is computationally intensive and not always successful.

When Is File Carving Used?

File carving is primarily used in digital forensics and data recovery. Common scenarios include:

• Recovering files from a formatted drive where the file system is rebuilt.
• Extracting evidence from a device where the user tried to delete files and wipe metadata.
• Recovering data from a corrupted partition where directory entries are unreadable.
• Retrieving files from memory cards or USB drives after accidental deletion.

It’s also used by law enforcement and cybersecurity professionals to uncover hidden or deleted data during investigations.

Common Problems and Limitations

File carving is not a magic bullet. Major challenges include:

• Fragmentation: Files stored in non-contiguous blocks are hard to reassemble. The more fragments, the lower the success rate.
• Overwriting: If new data has been written over the old file, carving cannot recover it. This is why you should stop using a device immediately after accidental deletion.
• File system complexity: Modern file systems (NTFS, APFS, ext4) use complex structures that can confuse simple carving algorithms.
• False positives: Carving can produce corrupt files that look like valid ones, especially when the header is found but the footer is wrong.

For SSDs, the TRIM command actively erases deleted data blocks, making carving nearly impossible on modern solid-state drives.

Comparison: Carving vs. Metadata-Based Recovery

Traditional recovery tools (like Recuva, TestDisk) rely on file system records. They are fast and accurate when the metadata is intact. Carving is slower and less accurate but works when metadata is destroyed. In practice, forensic tools combine both: first try metadata, then fall back to carving for missing files.

For example, if you format a USB drive, the file system is rebuilt, but the old data blocks remain. A metadata-based tool sees an empty drive; a carving tool can still find JPEGs and documents by their signatures.

Safety and Best Practices

If you need to recover deleted files, follow these guidelines:

• Stop using the device immediately – any new write can overwrite the fragments you want to recover.
• Use a read-only tool or create a disk image first. Work on the image, not the original drive.
• Do not install recovery software on the same drive you’re trying to recover from.
• For SSDs, expect failure due to TRIM; backup important data regularly.

Remember that file carving is a best-effort process. There is no guarantee of success, especially if the file was fragmented or partially overwritten.

Frequently Asked Questions

Can I recover a file that was deleted weeks ago?

Possibly, but the chance decreases with time and drive usage. If the drive has been used heavily since deletion, the fragments may be overwritten. On SSDs, TRIM likely erased them. On a lightly used HDD, there’s a decent chance.

What is the difference between file carving and data recovery?

Data recovery is the broad process of retrieving data from damaged or inaccessible storage. File carving is one specific technique within it, focusing on raw data scanning without metadata. Other recovery methods include repairing the file system or using backup software.

Does file carving work on SSDs?

Rarely. SSDs use TRIM, which immediately marks deleted blocks as free and erases them in the background. This destroys the data quickly. Some older SSDs or those without TRIM might still have recoverable data, but it’s not reliable.

What file types are easiest to carve?

Files with strong, unique signatures and clear internal structure, like JPEG images, PDFs, and ZIP archives, are easiest. Plain text files have no signature and are nearly impossible to carve reliably.

Is file carving legal?

Carving itself is a neutral technique. It’s legal for personal data recovery on your own devices. Using it to recover someone else’s data without permission may violate privacy laws. In forensic investigations, it’s performed under legal authority.

Related

• Fix Switch Sports Motion Control & Joy-Con Tracking
• Pixel Buds 2 Audio Cutout Issues: Fixes That Work
• Can LLMs Inspect Their Own Thoughts? Evidence

in t | Time since deletion | hours | 24 | 0
in s | Storage size | GB | 256 | 1
out p | Overwrite probability | % | min(100, (t * s) / 100) | 1