Notifications
Clear all

Noob carving query

3 Posts
3 Users
0 Reactions
614 Views
(@jmundy)
Eminent Member
Joined: 6 years ago
Posts: 25
Topic starter  

Does carving provide insight such as the date a file was deleted, the location it had been stored in and when and how many times it had been opened on the system? thanks


   
Quote
minime2k9
(@minime2k9)
Honorable Member
Joined: 14 years ago
Posts: 481
 

No. Carving is a process for purely finding data based of attributes of data (header/footer) etc.

Deleted file recovery uses metadata to recover files and this may provide that information, even if the file itself is not recoverable.

See here for more details
https://www.nist.gov/itl/ssd/software-quality-group/computer-forensics-tool-testing-program-cftt/cftt-technical/deleted

https://www.nist.gov/itl/ssd/software-quality-group/computer-forensics-tool-testing-program-cftt/cftt-technical-0


   
ReplyQuote
keydet89
(@keydet89)
Famed Member
Joined: 21 years ago
Posts: 3568
 

Does carving provide insight such as the date a file was deleted, the location it had been stored in and when and how many times it had been opened on the system? thanks

This is a good question, but also one that can be answered by thinking about what's being looked for.

Specifically, if file carving with file system unallocated space is the issue in question (one can also carve for individual records), using tools such as foremost, scalpel, PhotoRec, or commercial products such as XWays, then what we're looking at is recovering deleted files independent of file system metadata. This would include such things as file name and path, deletion date, etc.


   
ReplyQuote
Share: