← Back to Recovery methods

File-System Recovery vs. File Carving

Recovery software can find the same lost file in two fundamentally different ways. File-system recovery reconstructs the storage's own bookkeeping. File carving ignores that bookkeeping and recognizes file content directly. The difference determines whether names, folders, timestamps and fragmented files can come back correctly.

File-system recovery follows metadata

NTFS, APFS, ext4, XFS and other file systems keep structures describing files, directories, extents, timestamps and allocation. If enough survives, recovery software can reconstruct files in context.

Carving recognizes content

Carving searches raw sectors for signatures and internal structures associated with known formats. It can find data when original file-system metadata is unusable, but normally has no authoritative source for the original path or filename.

Fragmentation is the dividing line

Metadata can describe a file stored in many non-contiguous extents. A simple carver may not know where the next fragment belongs, which is why large video, archives, databases and virtual disks can be much harder than contiguous photos.

Use them as layers, not competing products

A sensible scan often tries metadata-based reconstruction first and carving as a complementary fallback. A pile of carved files does not prove that file-system reconstruction was impossible.

What you usually lose with carving

Original filenames, folder hierarchy and file-system timestamps are commonly unavailable. The content can survive while the context that made it useful does not.

Related: File Carving, Explained · File System Corruption · Memory Card Video Recovery