Data Carving

​

Overview

• Recovery of deleted files from unallocated space
• Extraction of embedded files from containers
• Detection of files with wrong or missing extensions
• Recovery from corrupted file systems

​

Supported File Formats

​

Images

• JPEG, PNG, GIF, BMP, TIFF
• RAW camera formats
• WebP, ICO

​

Documents

• PDF documents
• Microsoft Office (DOC, XLS, PPT)
• OpenDocument formats
• RTF, EML emails

​

Archives

• ZIP, 7-Zip, RAR
• GZIP, BZIP2
• TAR archives

​

Multimedia

• MP4, AVI, MOV, MKV
• MP3, WAV, FLAC, Opus
• 3GP mobile video

​

Databases

• SQLite databases
• Registry hives

​

P2P and Special

• BitTorrent files
• eMule/eDonkey
• Resume.dat files

​

Geodata

• GPX tracks
• KML/KMZ files

​

Architecture

/**
 * Data Carving Task using aho-corasick algorithm,
 * which generates a state machine from search patterns.
 * The algorithm is independent of the number of signatures,
 * being proportional to input data volume and number of discovered patterns.
 */
public class CarverTask extends BaseCarveTask

​

Efficiency

• Single pass scanning - All signatures searched simultaneously
• Performance - Takes less than 10% of total processing time
• Comprehensive - Scans more than just unallocated space
• Scalable - Performance independent of number of signatures

​

Configuration

<carverconfig>
    <carverTypes>
        <carverType>
            <name>PDF</name>
            <signatures>
                <headerSignature>%PDF-</headerSignature>
                <footerSignature>%%EOF</footerSignature>
            </signatures>
            <minLength>100</minLength>
            <maxLength>100000000</maxLength>
            <mediaType>application/pdf</mediaType>
        </carverType>
    </carverTypes>
</carverconfig>

​

Carver Parameters

• name - Unique identifier for the carver type
• headerSignature - File header pattern (hex or ASCII)
• footerSignature - File footer pattern (optional)
• minLength - Minimum valid file size in bytes
• maxLength - Maximum file size to prevent false positives
• mediaType - MIME type for carved files
• carverClass - Custom Java or JavaScript carver implementation

​

Specialized Carvers

​

PDFCarver

• Supports linearized and standard PDFs
• Validates internal structure
• Recovers fragmented PDFs when possible

​

SQLiteCarver

• Validates database header
• Checks page structure integrity
• Handles corrupted databases

​

ZIPCarver

• Locates central directory
• Validates CRC checksums
• Handles password-protected archives

​

MOVCarver & MatroskaCarver

• Parse container structure
• Locate media data atoms
• Handle streaming formats

​

OLECarver

• OLE2 compound file format
• Legacy Office formats (DOC, XLS, PPT)
• Outlook PST/OST files

​

JavaScript Carvers

function carve(signature, offset, evidence) {
    // Custom carving logic
    var data = evidence.getBytes(offset, 1024);
    
    // Validate file structure
    if (isValid(data)) {
        var length = calculateLength(data);
        return createCarvedItem(offset, length);
    }
    
    return null;
}

• Rapid prototyping of new carvers
• Format-specific validation logic
• No recompilation required

​

Carving Scope

​

Unallocated Space

​

File Slack

​

Known File Containers

• Documents
• Archives
• Disk images
• Memory dumps

​

Unknown File Types

​

Corruption Handling

public static boolean ignoreCorrupted = true;

• Validates carved file structure
• Discards files failing validation
• Reduces false positives
• Configurable per investigation needs

​

LED Carving

• Groups related file fragments
• Reconstructs fragmented files when possible
• Improves recovery of large multimedia files
• Implemented in LedCarveTask.java

​

Performance Optimization

​

Buffer Management

private byte[] buf = new byte[1024 * 1024]; // 1MB buffer

​

State Machine

• O(n + m + z) complexity where:
  • n = input length
  • m = total pattern length
  • z = number of matches
• Constant time per input character
• Efficient for thousands of signatures

​

Parallel Processing

• Separate thread per item
• No blocking of main pipeline
• Utilizes multi-core processors

​

Integration with Processing

• Added as child items of parent evidence
• Fully indexed and searchable
• Include parent relationship metadata
• Available in result view and gallery
• Can be bookmarked and exported

​

Use Cases

​

Deleted File Recovery

​

Anti-Forensics Detection

​

Steganography Investigation

​

Timeline Reconstruction

​

Malware Analysis

​

Best Practices

1. Enable for unallocated space - Set addUnallocated=true in FileSystemConfig
2. Adjust maxLength - Based on expected file sizes in your case
3. Enable validation - Use ignoreCorrupted=true to reduce false positives
4. Monitor performance - Carving should use less than 10% of processing time
5. Review carved items - Check for false positives in results

​

Limitations

• Cannot recover overwritten data
• Fragmented files may not recover completely
• File without clear footer signatures harder to carve accurately
• Performance depends on unallocated space size