Glossary
Data carving
Recovering files from raw bytes by their signatures, with no filesystem metadata to rely on. The fallback when the directory entry is gone.
Carving ignores the filesystem entirely. Instead of following a directory entry
to a file's clusters, you scan the raw bytes for known headers (FF D8 FF for
JPEG, %PDF for PDF, the local file header for ZIP) and pull out everything from
there to a matching footer or a sensible length.
It is how you recover data from unallocated space, from file slack, or from a disk whose partition table and metadata are destroyed. The limitation is fragmentation: carving assumes a file is contiguous, so a document split across non-adjacent clusters comes back truncated or garbled. Sizes are exact when a footer or length field exists, and approximated by scanning to the next header when they do not.
The parser carves by signature across any byte range of an image.