Data Carving: Signature-Based Data Recovery

The data recovery industry has come a long way since the first undelete tool was introduced by Microsoft back in 1991. Back in the 1990’s, all a data recovery tool would do was tripping the “deleted” flag back into the “undeleted” state, with no safety checks and iffy results at best.

Signature-Based Data Recovery

Today, the market offers a number of highly advanced tools with numerous safety checks and automation routines, allowing you to recover files even if you managed to rid of your file system completely. But first let’s look at why and how a data recovery tool works to help you get your files back.

Restore data of all types in a snap! Recovering absolutely all types of files

Deleting a File Doesn’t Mean Wiping Its Content

The very reason why data recovery tools can work is the fact that Windows does not automatically wipe the content of a file once you delete it from the disk. Instead, the system simply marks the file’s record in the file system to label it as “deleted”, thus releasing disk space previously occupied by that file for other files to use.

Note: if your computer uses an SSD drive instead of a traditional hard drive with spinning magnetic plates, that SSD drive will go ahead and wipe the content of a file you’ve just deleted in order to boost future writes and improve lifespan.

So what a data recovery tool actually does is analyzing the file system looking for those “deleted” labels, figuring out where exactly on the disk the content of the deleted file is located, and saving those chunks into a new file on another disk (flash drive, network location and so on).

Note: using a separate hard drive, a different drive letter, USB flash drive or memory card to store recovered files is essential. If you attempt to save the deleted file onto the same disk it’s been deleted from, you’ll risk overwriting the content of this and other deleted files instead of saving them.

Sounds simple? OK, so let’s make things a bit more complex. How about recovering files from a disk that has no file system such as a freshly formatted memory card, repartitioned hard drive, or simply a disk with corrupted file system? Apparently, a different approach is required to recover information from such devices.

Skip to the video
Recover Deleted Files and Repair Corrupted Partitions

Recover Deleted Files and Repair Corrupted Partitions

Carving: The New Approach to Recovering Data

Today’s data recovery tools don’t let the lack of a file system stop them. Instead of relying entirely on the file system, they can now scan the entire content of the device in order to automatically identify known types of files such as documents, emails, pictures and videos (as well as hundreds of other formats). They do that by literally carving the disk, reading its content one sector after another and trying to match information they read against a database of known file formats. That database contains characteristic signatures allowing the tool to tell that this sector contains the beginning of a JPEG file and that sector has a file header belonging to a PDF document.

Once a known file format is identified, the algorithm performs a number of slower secondary checks to make sure that the signature really represents a file header. If it does, the tool analyzes the header and tries calculating the file’s length (for many formats, this information is often stored at the beginning of a file). The rest is easy: by knowing where the file begins and calculating the file’s length, the tool can extract the needed number of sectors and recover the file.

Note: carving works best on contiguous, non-fragmented files. Fragmentation is your worst enemy when it comes to recovering deleted files. While it may be possible to determine the address of the first fragment, if the rest of the file is scattered around the disk, the data recovery tool will have no way to recover those fragments UNLESS there is still a file system in place.

Carving is often called by different trade names. Signature Search, Deep Scan, Power Search, and Content-Aware Analysis are just a few names referring to the same technology. When choosing a data recovery tool, make sure to pick one that comes with full signature-search capabilities such as Starus Partition Recovery or Starus File Recovery.

Top of the line product to repair broken partitions and recover missing information
Instantly recover deleted files and folders from all kinds of storage media


  • Evaluations:
  • 2
  • /
  • Rating:
Oleg Afonin

Oleg Afonin

Oleg Afonin is a security researcher and data recovery expert. He is the co-author of the popular book "Mobile Forensics - Advanced Investigation Strategies" and has spoken at well-known industry conferences such as CEIC, HTCIA, FT-Day, Techno Forensics and others. Oleg Afonin has been working with Starus Recovery since 2009. With years of experience in digital forensics and security, Oleg publishes useful material for our readers on recovering digital information from modern storage systems, hard drives, and solid state drives. His articles help our users solve many problems with subsequent data recovery.

Author's page


Read Our Frequent Questions

Comments (1)

  • Starus Recovery
    Starus Recovery 25.10.2018 01:12

    If you have anything to add or have questions on the topic of File Recovery with content analysis - share in the comments and we will answer!

Post Comment
Leave a reply
Your email address will not be published. Required fields are marked *

Similar articles

Similar articles about data recovery