What is data carving and when is it used?

• A. Recovering files by signature-based reconstruction from unallocated space when metadata is lost
• B. Scanning for known hashes in live memory
• C. Sorting files by size in the file system
• D. Archiving files into compressed bundles

Answer: (A)

Data carving is the process of recovering files by detecting their signatures and reconstructing them from raw data, without relying on the filesystem metadata. It looks for known file headers and footers (magic numbers) in areas like unallocated space or other regions where the file system’s records are missing or damaged, and then pieces together the file content based on those markers. This approach lets investigators retrieve fragments of evidence even when directory entries, allocation tables, or other metadata are gone, making it essential for situations where the structure that normally links data together has been lost.

Why this is the best description: it captures the core idea of carving—using file signatures to locate and reassemble files from raw data independent of metadata—and the typical scenario where it’s needed (unallocated or damaged space).

Other options aren’t about this technique: scanning for known hashes in live memory is memory-forensics and hash-matching, not reconstructing files from raw disk data; sorting files by size is a basic file-system operation, not a recovery method; archiving files into compressed bundles is about storage or packaging, not forensic data recovery.