File Carving, Explained
Most recovery tools work by reading the file system's own index — the map that says which file lives at which location. File carving throws that map away entirely and goes looking for files a different way: by scanning the raw data itself for the byte patterns that mark the start of a known file type.
How it actually works
Most file formats start with a distinctive sequence of bytes — a "signature" or "magic number." A JPEG typically starts with the bytes FF D8 FF; a PDF starts with %PDF; a ZIP file starts with PK. A file-carving tool scans a drive sector by sector, ignoring the file system entirely, and whenever it recognizes one of these signatures, it starts pulling out data from that point — usually until it hits the signature's known end marker, or a sensible size limit for that file type.
This means file carving works even on a drive whose file system is completely gone, unreadable, or was never there in a form the operating system recognizes — because it never needed to read the file system in the first place.
When this matters
File carving is the right tool specifically when normal, index-based recovery has nothing to work with:
- A drive that shows as RAW, where the file system structure itself is gone or unrecognized.
- File system corruption too severe for a repair tool to reconstruct.
- A drive that's been formatted more than once, where the old file system's index has been overwritten by a new one.
- Memory cards and cameras, where a corrupted or missing index is common — see Corrupted or Deleted Video from a Memory Card.
What it costs you
File carving isn't a strictly-better version of normal recovery — it trades away information that index-based recovery keeps:
- No original filenames. Carved files come back named by a sequence number or offset, not their original name.
- No folder structure. Everything comes back into one flat pile, regardless of what folder it used to live in.
- Fragmentation breaks larger files. If a file wasn't stored in one continuous block on the drive — common for larger files, especially video — carving can produce a corrupted or truncated result, since it generally can't follow a file's pieces across non-contiguous locations the way a file system's own index does.
- False positives. Random data can occasionally match a file signature by coincidence, producing garbage results mixed in with real recovered files.
File carving tends to work best on smaller, self-contained file types — photos, individual documents — and less reliably on large files, especially video, which are more likely to be fragmented across the drive. PhotoRec is the standard free tool for this and is named for exactly this original use case: recovering photos from memory cards.
If a first carving attempt came back with corrupted or incomplete files, that's often a sign of fragmentation rather than a sign nothing can be done. See what a hands-on evaluation looks like.