File carving is a technique used for retrieving deleted files or data from a hard drive or memory dump.
When data is hard deleted its metadata was deleted, so there is no longer a reference to its location in
the memory. By knowing the magic number, the file’s characteristic signature written in the header of the
file, file carving software will be able to recognise and identify similar files from its database of magic
numbers.
File carving is of no use when the header with the file signature has been overwritten by new data. In this
case, the file carving software won’t be able to find the magic number as it is no longer there. The
technique won’t work either when the files are heavily fragmented like on solid-state drives. It will fail to
put all the fragments together as they are not allocated to contiguous clusters on the drive.