Carving

From CNM Wiki
Revision as of 15:57, 18 July 2020 by QiratH (talk | contribs) (Created page with "Carving is (File/data content carving) The process of recovering and reconstructing file content directly from block storage without using the file system metadata. More g...")
(diff) ← Older revision | Latest revision (diff) | Newer revision → (diff)
Jump to: navigation, search

Carving is (File/data content carving) The process of recovering and reconstructing file content directly from block storage without using the file system metadata. More generally, data(structure) carving is the process of reconstructing logical objects (such as files and database records) from a bulk data capture (disk/RAM image) without using metadata that describes the location and layout of the artifacts. Data carvers use knowledge of the data formats to identify and validate the extracted content.

Definitions

According to the CyBOK (version 1),

Carving. (File/data content carving) The process of recovering and reconstructing file content directly from block storage without using the file system metadata. More generally, data(structure) carving is the process of reconstructing logical objects (such as files and database records) from a bulk data capture (disk/RAM image) without using metadata that describes the location and layout of the artifacts. Data carvers use knowledge of the data formats to identify and validate the extracted content.