Free Workshop: Investigating Insider Threats — February 20-27

File Carving

A disk image is composed of a number of blocks. File carving reassembles these fragments into as many complete files as possible. Sometimes a missing block or a corrupted file table will leave holes but whenever the complete data is possible the algorithms will reconstruct all of the files.