File Carving with the Foremost tool

File carving is an important subject area in computer forensics. It can be used by a forensics expert to recover hidden files and verify that those files were present on a suspected computer.

The purpose of this article is to explain what file carving is, what it is used for and how it is processed.

We will focus on the Foremost tool, what can be done with this tool and how to get it.

Keywords: file carving ; foremost ; traces

File carving is a field of computer forensics in which we are searching for hidden or deleted files based on raw data from a disk or flash memory.

Filesy stems all have metadata describing the hierarchy of stored documents (folders tree structure, files…) but file carving does not rely on these metadata but rather on raw data to identify and recover files.

A file can be identified by its header and footer for example a jpeg files raw data alays starts with 0xFFD8 and always ends with 0xFFD9.

We call these headers “magic numbers” or “file signatures”. A list of known signatures file can be found here: https://en.wikipedia.org/wiki/List_of_file_signatures .