Data carving

Data carving, also known as file carving, is the forensic technique of reassembling files from raw data fragments when no filesystem metadata is available. It is a common procedure when performing data recovery, after a storage device failure, for instance. It may also be performed on a core memory dump as part of a debugging procedure.

Data recovery, Filesystem, Security terms, Storage device